Lion Cipher Lab
Run a full detection-engineering cycle: emulate, detect, tune (purple-team SOC capstone)
- SOC Analyst / Blue Team
- Advanced
- ~2-3 hours
- Free · no account required
Why it matters
Individual detection tools are easy to collect and hard to trust. The question a SOC actually has to answer is: 'If an adversary did X on our network, would we see it?' The only honest way to answer that is to safely do a benign version of X yourself, look for the alert, and fix your detection when it does not fire — the purple-team loop. This capstone is where the scattered blue-team skills become detection ENGINEERING: you stop hoping your coverage is good and start measuring it, one ATT&CK technique at a time. That measured, close-the-gap discipline is exactly what separates a detection…
What you'll learn
- detection engineering
- purple teaming
- adversary emulation
- measuring detection coverage
- Sigma rule authoring and tuning
- closing the attack-detect-verify loop
- mapping detections to MITRE ATT&CK
Steps in this lab
- The one rule: your own, isolated host — and a benign attack
- The loop you are about to run
- Step 1 — Confirm your endpoint is actually watching
- Step 2 — Install the emulation harness (Invoke-AtomicRedTeam)
- Step 3 — Look before you leap: read the test you will run
- Step 4 — EMULATE, then MEASURE the gap
- Step 5 — TUNE: write the detection that closes the gap
- Step 6 — DEPLOY: convert the rule into a query your log search runs
- Step 7 — VERIFY: re-run the SAME test and prove the alert fires
- Step 8 — Now go around again (and why this is the job)