Training Modes
Training Modes Overview
Choose between guided Operations rooms or real-time Shift Mode.
Training Modes
SOC Simulator offers two training modes designed for different learning styles and skill levels.
Mode Comparison
| Feature | Operations | Shift Mode |
|---|---|---|
| Style | Guided, step-by-step | Real-time, unstructured |
| Time Pressure | None | Yes (configurable) |
| Alerts | Pre-defined scenarios | Live streaming |
| Objective | Capture flags | Find hidden attacks |
| Best For | Learning tools | Building reflexes |
| Difficulty | Easy → Hard rooms | Easy/Medium/Hard modes |
Which Mode Should I Start With?
Operations Mode
Start here if you're new. Guided rooms with clear objectives, hints when stuck, and immediate feedback.
Shift Mode
For experienced analysts. Real-time alert triage under time pressure with hidden attack scenarios.
Recommended Learning Path
Beginners (0-1 years experience)
- Complete all Easy Operations rooms
- Move to Medium Operations rooms
- Try a 15-minute Easy Shift
Intermediate (1-3 years experience)
- Complete Medium and Hard Operations rooms
- Practice 30-minute Medium Shifts
- Focus on specific tool mastery
Advanced (3+ years experience)
- Challenge yourself with Hard Shifts
- Aim for top leaderboard positions
- Complete full 8-hour Shift simulations
Skill Building
Both modes contribute to your skill profile:
- Tool Mastery - Experience with SIEM, XDR, Firewall
- MITRE ATT&CK Coverage - Techniques you've encountered
- Triage Accuracy - Correct decisions percentage
- Response Time - Average time to make decisions
- Correlation Ability - Connecting related alerts
Track your progress on the Dashboard and Profile pages.