Five SOC Investigation Labs

Five SOC Investigation Labs is a cybersecurity training product available on the Whop marketplace, created by Cyber Armory and launched in October 2026.

Five complete investigations. Each generates its own realistic log data on your machine, hands you a brief, and lets you check your answers without being shown them. The five • Phishing to lateral movement — Sysmon and Windows Security • Ransomware precursor — the window before encryption, 48 minutes to spare • Insider data theft — no malware anywhere in it • Web server compromise — nginx and syslog, so grep and awk rather than jq • Cloud identity — Entra ID, a stolen token, MFA that never prompted Five scenarios, five telemetry formats, one fictional company throughout. Why they are worth doing The alert is never the beginning. In every lab it fires late, and in two of them it points at the wrong host. Every lab has a decoy that survives a first look — someone whose behaviour seems wrong until you read the context and find they were doing their job. None can be solved by stacking a single field. If one sort and uniq produced the answer, the detection it implies would fire constantly in production. What you get Five Python 3 scripts, standard library only. A brief and questions for each. SHA-256 answer keys, so you can check yourself without spoiling the next step. A full walkthrough per lab, command by command. A cheat sheet for jq, awk and the event IDs used. Deterministic, so the walkthroughs match what you see. Runs on Linux, macOS, WSL or Git Bash. No VM, no account, nothing expires. Not a course. It assumes you can open a terminal.

Five SOC Investigation Labs offers free access.

Five SOC Investigation Labs offers a 30% affiliate commission for promoters. Track Five SOC Investigation Labs's estimated revenue, member growth trends, and competitive market position on Whop Trends.