← More A new lab every month

Cyber Forge

Learn security tools by actually using them. Each month a different SOC or NOC platform goes live with real data and guided tasks, and then you explore it freely.

Join this month's lab →How it works
SOCNOCSIEMThreat huntingTriageDetection
Why Cyber Forge

Built for people heading into security and network operations

🎯Career-focused

For anyone aiming at a Security or Network Operations Centre, or learning SIEM and monitoring tools.

🧪Real data, real alerts

Labs run on genuine historical logs plus a staged intrusion, not toy examples.

🧭Guided, then free

Finish the guided tasks, then keep exploring the live tool until the month ends.

🔄New tool monthly

The lab is wiped at month end and a different platform takes its place.

This month

Current lab

Click the card to open it.

0days
0hrs
0min

About the tool

Wazuh is a free, open-source platform that combines SIEM and XDR. SOC teams use it to collect logs, detect threats, map alerts to MITRE ATT&CK and investigate incidents. This lab is a live Wazuh instance loaded with real historical SSH and Apache logs plus a staged intrusion.

What you'll do

  • Triage an SSH brute-force campaign
  • Cross-reference a second incident
  • Hunt for the one login that matters
  • Tell scanning from a targeted attack
  • Rebuild an attack chain and write it up

Requirements

  • A modern web browser. Nothing to install
  • About 45 to 60 minutes
  • Basic idea of IP addresses and SSH helps

Access the lab

  1. Open the lab and accept the sign-in page.
  2. Log in with the shared read-only account below.
  3. Choose Security events and set the time range to the last 24 hours.
User cyberforge-guest
Password CyberforgeGuest$$01
Open the Wazuh lab ↗

Workbook

Prefer a printable guide? The same tasks, with an answer key at the back.

⬇ Download the PDF workbook

Guided lab 0/5

Coming up

Next labs

The tool changes every month. Announcements land here.

Coming Soon
🔭
December 2026

To be announced

A new SOC or NOC platform

Coming Soon
📡
January 2027

To be announced

A new SOC or NOC platform

Coming Soon
🧰
February 2027

To be announced

A new SOC or NOC platform