SOC lab
Train on the real briefing board
- Unified SOC is the morning standup screen.
- Analysts learn triage hotkeys against live-looking queues.
- Cohort seats via contact — demo opens the trial.
CyberDragon Academy
Hands-on OT/ICS cyber defense training with measurable outcomes.
Per-student K8s namespace + simulated OT (OpenPLC + Modbus). Target: MTTD under 60 seconds for Tier 1 attacks.
Lab scenarios
Students run the same six scenarios the platform is measured on.
Every exercise executes against simulated OT traffic in an isolated namespace, so a mistake costs a lab reset — never a process upset.
Hunt
Threat Hunt workbench in class
- Senior-analyst path includes hunt lead.
- Same corpus as production Core.
- Honest about demo vs live backends.
Console coverage
Training walks the console the way an analyst does.
| Module group | Screens covered |
|---|---|
| SOC Operations | Unified SOC, Alert Triage, Incident Queue, Workspace, Playbooks, Threat Hunt, UEBA |
| Edge & OT | Collector Status, Protocol Inspector, Purdue Topology, Fleet Management |
| Risk & Threat Intel | Risk Dashboard, FAIR Quant, Threat Ops Queue, TI Fusion Center |
| Compliance & Quantum | Quantum Readiness, Compliance & Audit, Network Assurance, Governance Rollup |
| Industry Verticals | OT/Energy, Banking, Cloud, IIoT, Healthcare, Unified SOC Queue |
| Executive | CISO Executive, Board Risk Brief, Verticals Overview, Executive Briefing |
| MSSP & Partners | Cross-Tenant Ops, Client Onboarding, Marketplace |
Playbooks
SOAR without skipping OT policy
- Run, then see the Tier-3 queue.
- We do not automate against the plant floor.
- YAML for repeatable labs.
FAQ
Frequently asked questions.
What does the lab environment include?
A per-student Kubernetes namespace with simulated OT — OpenPLC and Modbus traffic — so exercises run against real protocol behavior.
Which certification should an analyst start with?
CyberDragon Operator (CDO) for triage, evidence handling, and safe escalation, then CyberDragon Analyst (CDA) for detection engineering.
Is there a measurable outcome?
Yes — the training target is mean time to detect under 60 seconds for tier-1 attack scenarios.
Train on a live tenant.
Start the 7-day free trial, then ask the team about Academy seats.