Test cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Free, independent knowledge assessments. Review the scope, preparation and scoring before you begin. Suggested times are study guidance; passing can earn a Threat Intelligence Lab platform certificate, not an accredited or third-party vendor qualification.
Start with a course check, a source-based investigation or a specialist topic.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
22 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
28 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsExamine SVR exploitation of TeamCity, software-build risk, EDRSandBlast defense evasion, GraphicalProton's cloud covert channel, registry collection, and server-log evidence.
Review assessment : AA23-347A SVR TeamCity Supply-Chain Foothold InvestigationAnalyze ALPHV Blackcat's social engineering, remote tooling, adversary-in-the-middle credential theft, Kerberos access, defense evasion, exfiltration, and encryptor artifacts.
Review assessment : AA23-353A ALPHV Blackcat Access and Affiliate Tooling ResearchReconstruct a state-government intrusion from a retained former-employee account through SharePoint credential exposure, LDAP discovery, CIFS access, and cloud scoping.
Review assessment : AA24-046A Former-Employee Account and LDAP Evidence InvestigationAssess how SVR operators target service and dormant accounts, reuse tokens, manipulate MFA enrollment, and hide authentication behind residential proxies.
Review assessment : AA24-057A SVR Cloud Identity and Session-Persistence AnalysisInvestigate Akira's evolving hypervisor targeting, identity tradecraft, defense evasion, and virtual-disk credential theft using the official joint advisory.
Review assessment : AA24-109A Akira Hypervisor and Credential-Theft InvestigationTrace an Iranian access operation from password spraying and MFA registration through Kerberos discovery, living-off-the-land reconnaissance, and probable resale of network access.
Review assessment : AA24-290A Iranian Credential-Access InvestigationInvestigate how an unpatched remote-management component exposed a software provider's downstream customers and determine the correct discovery and response steps.
Review assessment : AA25-163A SimpleHelp Downstream-Exposure InvestigationResearch GitHub's official APIs to retrieve security advisories, apply vulnerability filters, export dependency evidence, and interpret SPDX package and relationship data for supply-chain decisions.
Review assessment : GitHub Advisory and SBOM InvestigationResearch Kubernetes auditing to identify event stages, select policy levels, understand first-match evaluation, configure the API server, and balance investigative detail with sensitive-data exposure.
Review assessment : Kubernetes Audit Policy Technical InvestigationResearch Google Cloud's official audit-log structure to identify log classes, principals, services, methods, resources, policy denials, and the correct filters for security investigations.
Review assessment : Google Cloud Audit Log Evidence InvestigationResearch AWS CloudTrail's official event schema to attribute API activity, interpret assumed-role sessions, preserve source identity, and distinguish reliable event fields from contextual clues.
Review assessment : AWS CloudTrail Event Attribution InvestigationResearch Microsoft Entra and Microsoft Graph documentation to distinguish sign-in types, interpret risk and Conditional Access fields, understand aggregation, and avoid misreading identity evidence.
Review assessment : Microsoft Entra Sign-In Evidence InvestigationResearch NIST's official NVD developer documentation to distinguish CVE publication from NVD enrichment, navigate CVE API responses, and build precise CPE and pagination queries.
Review assessment : NVD CVE, CPE, and API Record Investigation