Choose your workspace

Open lab environment

Start with the environment first, then practice freely. Free users get 10 minutes per day here; premium users get unlimited access. These open environments do not stop when a specific command or query is typed.

defensive

SOC / SIEM Console

Investigate generated alerts, click into details, create cases, run simulated searches, triage findings, write hypotheses, and practice escalation.

Live alerts

Case queue

Threat hunt

terminal

Kali Linux Sandbox

Practice a Linux-like terminal with safe simulated filesystem, logs, network views, process listings, notes, and evidence files.

Linux CLI

Fake logs

No exec

This is still simulation-only: commands and queries are interpreted by CyberCLI Web and return predefined or generated training output. Nothing is executed on the server and no external target is contacted.