PracticeSIEM is a free, browser-based hands-on training platform for SOC analysts, with its core positioning being "investigation rather than quiz." It offers 28 real security incident cases, each accompanied by raw log artifacts (such as auth.log, nginx access logs, CloudTrail exports), and comes with a usable search console that lets users practice incident response and threat hunting skills in the browser. No account, installation, or download is required; all log parsing, search filtering, and scoring are done client-side.
Main capabilities
- Real log artifacts: Each case provides actual log files, with no summaries and no multiple-choice questions.
- Search console: Supports field filtering, comparisons, and wildcards; clicking a value in the field sidebar automatically writes that filter condition into the search bar, helping users become familiar with query syntax.
- Real triage tasks: Case tasks follow a real triage workflow—scoping out the noise, identifying the attacker, pinning down the timeline, and then writing the detection query that should have caught the threat earlier.
- Parsing of eight log formats: Supports Linux syslog/auth.log, Nginx web access logs, BIND DNS queries, Windows Security event logs, AWS CloudTrail JSON, UFW/iptables firewalls, vsftpd FTP logs, and CSV integrity reports; every field that a SIEM would extract can be filtered in the console.
- Open cases, ordered from easy to hard.
How to use Open PracticeSIEM in the browser, choose an open case, use the search console to read raw logs, apply field filters and wildcard queries, complete each case's triage tasks, and submit answers in the interface; the system completes scoring client-side. There is no need to install Splunk, ELK, or a virtual machine.
Use cases
- Beginners or career changers who want to practice SOC analyst skills.
- Working analysts who need to improve incident response, threat hunting, and detection query writing abilities.
- Learners who want to become familiar with multiple log formats and real attack scenarios (such as brute force, credential stuffing, SQL injection, DNS tunneling, Kerberoasting, AWS IMDS SSRF, lateral movement, ransomware detection, and MITRE ATT&CK Enterprise and Cloud techniques).
Limitations
- The number of cases is 28, so the content scale is limited.
- The official materials do not mention whether paid premium content, certifications, or additional case updates are provided.
- No mobile adaptation is provided, offline use, or team collaboration features.
- Details such as specific platform compatibility and language support are not yet provided.
