Cyber Range for SOC Teams: A Practical Guide to Security Team Training
A cyber range for SOC teams is a browser-based place where analysts practice the work of the queue on real evidence: triaging alerts, investigating in a SIEM, and working endpoint and network artifacts from real intrusions. Labs are organized by tier and skill, scored as analysts work them, and visible to the team lead, so training can be planned by tier and progress can be seen per analyst.
At 03:10 a Tier 1 analyst closes an alert as a false positive. Encoded PowerShell on a marketing laptop, parent process explorer.exe, nothing else firing. It is the fortieth alert of the shift and the previous thirty-nine looked the same. Nine days later the ransomware note appears and the timeline leads back to that laptop. The analyst was not careless. They had seen encoded PowerShell in a course slide and in hundreds of benign admin scripts. They had never seen it as the first visible step of a real intrusion, with the evidence in front of them, and been shown afterward what they missed.
SOC work is judgment under volume, and judgment is built by making the calls and being corrected. This guide covers how a SOC uses a cyber range to do that: what analysts practice, how it maps to Tier 1, 2, and 3, how to train as a team, how to measure it, and what a simple program looks like. The tracks and labs named below are from our own library. For what a cyber range is in general, see what a cyber range is.
Why SOC teams need hands-on training
SOC analysts need hands-on training because their job is a stream of fast decisions about ambiguous evidence, and only practice on realistic evidence improves those decisions. Courses teach what an attack looks like in isolation. The queue shows it surrounded by hundreds of things that look similar.
Three things make the gap wider in a SOC than in other security roles. Volume: analysts make more consequential calls per shift than anyone else in security. Turnover: SOCs onboard constantly, and each new analyst rebuilds the same judgment from zero unless there is a way to transfer it. Tiering: the structure that makes a SOC efficient also caps each analyst’s skill at their tier until someone deliberately trains them past it. We traced where that gap first shows up in why SOC analysts fail their first real incident response.
A cyber range gives every analyst reps on realistic evidence with an answer key at the end, turns onboarding into a fixed set of labs instead of months of shadowing, and lets a lead train a Tier 1 analyst on Tier 2 work before promoting them.
A cyber range for SOC teams: what analysts practice
SOC analysts practice the same things on a cyber range that they do on shift: triage, SIEM investigation, endpoint investigation, network investigation, and recognizing attacks as chains rather than single events. Each is below with labs that train it.
Alert triage
Triage is the first decision: is this real, what is it, how urgent is it? Triage labs start from an artifact or indicator the way an alert does, and the analyst has to enrich it, pull indicators, map the behavior to MITRE ATT&CK, and reach a verdict.
Labs: Yellow RAT and Red Stealer (enriching malware artifacts through VirusTotal and MalwareBazaar to identify infrastructure and techniques), and Oski (reading a sandbox report to pull out malware behavior and configuration). Each runs about 30 minutes, which suits a triage rep.
SIEM investigation
Most SOC investigation happens in a SIEM, and the skill is query discipline: knowing which data answers which question, filtering noise without filtering out the attack, and correlating log types into a timeline. SIEM labs put the analyst in a working SIEM with real logs and an open question.
Labs: REvil - GOLD SOUTHFIELD (Sysmon logs in Elastic, investigating ransomware behavior), AWSRaid (CloudTrail logs in Splunk), and for analysts on Microsoft estates, DynamicEscalate (an Entra ID privilege escalation reconstructed with KQL).
Endpoint investigation
When an alert points at a host, the analyst has to answer what ran, when, launched by what, and what it left behind. That means memory analysis, event logs, and timeline building with the standard forensic tools. This is where Tier 1 analysts most often stall, because the tools are unfamiliar and the evidence is dense.
Labs: RedLine and Reveal (Volatility against Windows memory dumps), and a step up, Andromeda Bot - UNC4210 (MemProcFS, EvtxECmd, and Timeline Explorer to rebuild an infection timeline). The Memory Forensics and Disk Forensics tracks group these by difficulty.
Network investigation
Network evidence answers what endpoints cannot: where the attacker came from, where they went, and what left. The skill is reading traffic for the attack rather than the protocol: lateral movement in SMB, credential theft in name-resolution traffic, a web shell in HTTP.
Labs: PsExec Hunt (PsExec lateral movement in SMB traffic), PoisonedCredentials (LLMNR/NBT-NS poisoning), and WebStrike (web shell, reverse shell, and exfiltration in a web server compromise). The Network Forensics track runs from easy to hard.
Threat detection
Detection in a SOC starts with recognizing a full kill chain rather than one event. GhostConnect - TA583 trains exactly that: Sysmon process trees, browser artifacts, and Mark-of-the-Web streams reassembled into the chain from phishing delivery through Active Directory enumeration to exfiltration. Every lab page lists the MITRE ATT&CK tactics that lab covers, and the labs catalog filters by tactic, which is how a lead plans training by tactic instead of by lab title. Proactive hunting is its own discipline and is covered in Cyber Range for Threat Hunting Training.
Escalation and coordination
Labs end at findings. What happens next, the escalation note and the handoff to the next tier or to incident response, is the SOC’s own process, and it is practiced around the lab rather than inside it. The simplest way: after an analyst finishes a lab, have them write the two-paragraph escalation they would send on shift (host, user, timeline so far, open question) and review it in the debrief alongside their answers. The response lifecycle after the handoff is covered in Cyber Range for Incident Response Training.
Tier 1, Tier 2, and Tier 3 training
Tiered training means giving each tier labs that exercise its current job and the next tier’s. Definitions vary between SOCs, but the pattern is stable: Tier 1 monitors, detects, and escalates; Tier 2 investigates in depth; Tier 3 hunts, does forensics, and handles complex incidents.
Tier 1
Tier 1 analysts need volume on triage and enough tool familiarity that a memory dump or a packet capture does not stop them. Labs should be short, 30 to 60 minutes, and structured. The SOC Analyst Tier 1 track is built this way: 24 labs across four levels, starting with Wireshark-based web attack investigations (JetBrains, RetailBreach) and moving through threat intel enrichment, memory analysis, and cloud logs.
Tier 2
Tier 2 analysts own the investigation. They need labs with several evidence sources and an open question about scope: how many hosts, how many accounts, how far back. The SOC Analyst Tier 2 track is the largest in our library at 89 labs, weighted toward SIEM investigation and detection, and the Threat Hunting and Malware Analysis tracks cover the specialisms a Tier 2 analyst is expected to have. CCDL1, a scenario-driven SOC Tier 1 exam run in a live environment, is a clean milestone for analysts moving up from Tier 1.
Tier 3
Tier 3 analysts need hard, open-ended labs and a role in training the tiers below them. The SOC Analyst Tier 3 track covers advanced hunting, forensic investigation, and complex incident management across 26 labs. Just as important, Tier 3 analysts should lead the debriefs. The fastest way to transfer senior judgment is to have the senior walk a Tier 1 analyst through where their path diverged from the answer.
Training as a team
Labs are worked individually, and a SOC still trains as a team by working the same lab and debriefing together. That is where the coordination problems show up: two analysts who scoped the same host differently, a junior who stopped at the first foothold, a senior who found the second one and can explain how.
The routine that works is simple. Assign one lab to the whole tier or the whole team for the week. Everyone works it on their own time. At the end of the week, a senior analyst runs a thirty-minute debrief: the intended path, where people diverged, and which evidence they were not looking at. The Team Management Dashboard shows who has completed it and how each analyst scored, so the debrief starts from facts rather than memory. How training is managed across many teams and regions is covered in Enterprise Cyber Range: How Security Teams Train Against Real-World Attacks.
Measuring SOC skills
SOC skills are measured on a cyber range by what each analyst completes and how they score on labs with a known answer, tracked over time and compared across the team. That is more useful than course completion, because a lab score reflects whether the analyst found the evidence, not whether they watched the module.
For a SOC manager, four things in the Team Management Dashboard are worth reading each month: which labs and tracks each analyst has completed, how they scored, which skill areas they have covered and which they have not touched, and whether both are moving quarter to quarter. Assign the same set of labs at the start of a quarter and an equivalent set at the end, and the change is the measurement. Turning that into a business case is covered in Measuring Cyber Range ROI.
Onboarding and continuous training
Onboarding on a cyber range replaces months of shadowing with a fixed set of labs every new analyst completes in their first weeks, so the manager knows what each hire can do by a known date. Continuous training keeps skills from fading and covers new techniques as they appear.
For onboarding, assign the Tier 1 track or a subset of it, set a completion window, and review each new analyst’s results with a senior at the two-week mark. Keep some shadowing for what a lab cannot teach: your ticketing conventions, your escalation contacts, your environment’s normal.
For continuous training, the pattern that holds is one lab per analyst per week matched to their tier, a team debrief each month, and the same baseline set repeated each quarter. New labs matter here. We release new labs every week, so a SOC can train on the techniques in this quarter’s threat reporting rather than last year’s. Fork Bomb - TeamPCP (a real supply chain attack traced from first alert to attribution) and CursorJack (a developer-workstation intrusion that reaches a multi-region cloud compromise) are the kind of current labs that keep a SOC’s mental model up to date.
Example SOC training program
A working program runs on a quarterly cycle with a weekly rhythm inside it. The version below assumes a SOC with all three tiers; smaller SOCs collapse the tiers and keep the rhythm.
| When | Tier 1 | Tier 2 | Tier 3 |
|---|---|---|---|
| Week 1 (baseline) | Two Tier 1 track labs: one triage, one endpoint | Two Tier 2 labs: one SIEM, one network | One Tier 3 lab; lead the Tier 1 debrief |
| Weekly | One 30 to 60 minute lab from the Tier 1 track | One Tier 2 lab, plus one skill-track lab in the weakest area | One Tier 3 or hard skill-track lab |
| Monthly | Team debrief on a shared lab | Team debrief on a shared lab | Run the team debrief |
| Quarter end | Repeat the baseline labs; review the change | Repeat the baseline; CCDL1 attempt if ready | Repeat the baseline; plan next quarter’s labs |
New hires start at Week 1 whenever they join and move into the weekly rhythm once their onboarding set is done. Writing this up as a program with budget and reporting is covered in building a cybersecurity team training program.
Put your SOC on a cyber range this month
The quickest test of whether a cyber range fits your SOC is to run one tier through one baseline lab and read the results together. If you manage a team, book a walkthrough of our cybersecurity training for teams and enterprises and we will show you the tier tracks and the Team Management Dashboard. If you want to try the labs first, start with the SOC Analyst Tier 1 track or browse the free cybersecurity labs. Everything runs in the browser with nothing to install.
FAQ
Which cyber range labs should a Tier 1 SOC analyst start with?
Start with short network and triage labs that use tools the analyst will see on shift: JetBrains and RetailBreach for Wireshark-based web attack investigation, Yellow RAT and Red Stealer for indicator enrichment, then RedLine for a first memory analysis. The SOC Analyst Tier 1 track sequences these across four levels so the difficulty rises with the analyst.
How many hours a week should SOC analysts spend on a cyber range?
One to two hours a week per analyst is enough to build and hold skill if it is consistent: one 30 to 60 minute lab plus a short debrief fits most shift patterns. Concentrating the same hours into one quarterly day produces less, because skills fade between sessions.
Can a cyber range replace shadowing during SOC onboarding?
It replaces most of it. Shadowing transfers judgment slowly and unevenly, depending on which incidents happen and which senior is on shift. A fixed set of labs gives every new hire the same incidents with an answer key attached, and shows the manager what the hire can do by a known date. Keep shadowing for your own conventions and contacts.
Does a SOC need a cyber range if it already runs purple team exercises?
Yes, for a different purpose. Purple team exercises test whether your controls and detections catch a red team’s techniques in your environment. A cyber range trains the analysts’ judgment on realistic evidence at volume. Purple teaming a few times a year shows where detection gaps are; weekly lab practice is how analysts get better at working what the detections surface.