Open app

Train in a SOC, not on slides.

Ten mock security consoles run on one fictional company, so the same people, hosts and IDs follow you from tool to tool. Six incidents, twenty scored drills, eight guided labs and live analyst shifts, all in the browser.

Open free tools See the whole platform No account needed to explore.
THREAT-001SI-015ALT-7274DET-0037SI-016DLP-001TRF-98177TA-001INV-2024-0087CASE-2024-0087IR-001Exposure review
Stop 1 of 12: THREAT-001. An invoice lure from invoices-secintel.io reaches Finance manager Marcus Chen. Open record
THREAT-001SI-015ALT-7274DET-0037SI-016DLP-001TRF-98177TA-001INV-2024-0087CASE-2024-0087IR-001Exposure review

Route shown: IRON CHIMNEY, one of six incidents on the network. Also running: BEC-001 CEO Wire FraudATO-002 MFA FatigueINSIDER-001 Source Code TheftSUPPLY-001 Supply-Chain StagingVF-001 Vendor Fraud.

See all 12 stops on this route
  1. 06:46:38 UTC · T1566.002Foyl MailGuardTHREAT-001An invoice lure from invoices-secintel.io reaches Finance manager Marcus Chen.Open
  2. 06:52:19 UTC · T1539Foyl IdentitySI-015His captured Microsoft 365 session is replayed from 185.220.101.42 with no new MFA challenge.Open
  3. 06:53:24 UTC · T1539Foyl SIEMALT-7274The SIEM raises the session replay alert.Open
  4. T1003.001FoylGuard EDRDET-0037rundll32 accesses LSASS on FINANCE-WS-01.Open
  5. T1021.002Foyl IdentitySI-016James Okafor's compromised account moves through SI-DC-01 to RESEARCH-STATION-01.Open
  6. T1041Foyl CASBDLP-00147 restricted research files are staged for transfer.Open
  7. T1041Foyl NGFWTRF-98177A 547 MB session leaves over the campaign C2 channel.Open
  8. CAM-001Foyl TIPTA-001Intelligence ties the activity to IRON CHIMNEY and Operation SMELTING, with 14 IOCs.Open
  9. 6 correlated alertsInterchangeINV-2024-0087Six security events correlate into one investigation, owned by Security Analyst j.mercer.Open
  10. PB-001 · PB-003 · PB-006Foyl SOARCASE-2024-0087The response case and the playbooks that carry containment.Open
  11. 10 sub-tasksFoyl QueueIR-001The incident ticket splits into ten sub-tasks, with scoping for James Okafor in IR-004.Open
  12. Post-incidentFoyl VMRESEARCH-STATION-01An exposure review for the research host after 847 files were encrypted.Open

Every incident, company, person, host and domain on foyl is fictional.

One network, from your first alert to a verified record.

Every part of foyl runs on the same consoles and the same fictional company, so what you learn in a drill shows up again in a lab, a shift and a report.

  • Free zone No account needed
  • Full platform Through a verified instructor's class

Main line

  1. Consoles 10 mock tools

    SIEM, EDR, identity, email and six more, all on one fictional company.

    Free zone
  2. Drills 20 scored drills

    Short, replayable reps. Triage alerts, hunt raw logs, rebuild timelines.

    Free zone
  3. Labs 8 labs · 2 free

    Incident chains from initial access to containment, gated and scored.

    Partly free
  4. Scenarios 6 incidents

    Every console, one shared SOC, with step-by-step instructor walkthroughs.

    Full platform
  5. Range 3D network map

    Replay incidents hop by hop across the network and contain the breach.

    Full platform
  6. Shifts 3 curated desks

    Thirty minutes on a live analyst desk, scored at handoff.

    Full platform
  7. Reports 6 report builders

    Write the incident report yourself and get it scored.

    Full platform
  8. Dossier Verified analyst record

    Labs, drills, shifts, reports and standards coverage on one page.

    Full platform

Study line

  1. Cert practice 300+ certifications

    Question bank and practice exams, Security+ to OSCP to CISSP.

    Free zone
  2. ATT&CK Enterprise matrix

    Techniques, APT groups and campaign routes, explored interactively.

    Free zone
  3. Interview prep By role

    Real questions with answers that explain what interviewers want.

    Free zone
  4. Glossary Plus concepts

    The vocabulary and the ideas behind it, linked from every console.

    Free zone

Reaching zone 2. Students in an active class owned by a verified instructor get the full platform. Not in a class yet? Write to support@foyl.io.

Ask about access

Shifts put you on a live analyst desk for thirty minutes.

Alerts arrive on the clock. You pull evidence from the same consoles, contact the people involved, make a call on every alert and leave a handoff the next analyst can trust. The debrief then scores your judgment case by case.

  • Guided, Standard or Independent. The incident stays identical. Only the coaching changes.
  • Two real leads and one distractor on every alert. Only evidence that holds up counts at handoff.
  • Scored out of 100, with the instructor truth revealed for every case.
Take a shiftFull platform
Capstone02:00 - 02:30 simulated
Black Sky
07:52ON SHIFT
?PauseHand off & endStop
2open cases
4alerts dispositioned
3people contacted
5consoles opened
57%shift coverage
Case queue1/3 resolved
CRIT 3HIGH 2MED 2LOW 0
Needs attention
criticalINV-2024-0091working NIGHT LEDGER Exfiltration · 5 alerts · 3 IoCs 3/5T+21:00
mediumIPS-5832new Vendor access validation Containment boundary · 1 alert 0/1T+16:00
Resolved
mediumDET-0071resolved Overnight support activity Endpoint validation · 1 alert 1/1T+3:27
PulseOps4HandoffNotebook
Threat intelligence

Recovery team: the primary backup catalog is exposed - confirm immutable copies before impact.

Correlation

Correlation: a second endpoint now shows the same encrypting binary hash.

Leadership

Incident commander: declare if you see multi-stage activity. Protect research data first.

Sensor health

SI-FILE-01 stopped reporting to the SIEM - possible impact on the file server.

Recreated from the live desk. Each desk shows its real alerts, cases and ops events. Progress, counts and the clock are an example state 22 minutes in.

Ten lines. Every one is free to ride.

Each console is a working mock of a tool analysts use every day, loaded with the same fictional company. A lead in one opens the matching record in the next.

  • Identity

    Foyl Identity

    Risky sign-ins, session replay and the audit trail behind every account.

    Open

  • MailGuard

    Foyl MailGuard

    Phishing triage, message search, forwarding rules and account takeover.

    Open

  • SIEM

    Foyl SIEM

    Correlated alerts, searches and the investigations that tie evidence together.

    Open

  • EDR

    FoylGuard EDR

    Endpoint detections, process activity and host isolation.

    Open

  • TIP

    Foyl TIP

    Threat actors, campaigns, IOCs, feeds and intelligence reports.

    Open

  • CASB

    Foyl CASB

    Cloud app usage, DLP incidents, policies and risky users.

    Open

  • NGFW

    Foyl NGFW

    IPS events, threat logs and traffic sessions at the perimeter.

    Open

  • SOAR

    Foyl SOAR

    Response cases, playbooks and automation runs.

    Open

  • Queue

    Foyl Queue

    Tickets, sub-tasks, sprints and SLAs for the work after triage.

    Open

  • VM

    Foyl VM

    Vulnerability findings and exposure reviews by asset.

    Open

Bring the same practice into your classroom.

Assign the work, observe accepted activity, and review the evidence behind a learner’s result. foyl provides telemetry and rubric inputs. You decide how they inform your course and you decide the grade.

  1. AssignBuild a syllabus from real platform activities.
  2. ObserveSee accepted activity, completion, attempts, and assistance.
  3. ReviewOpen evidence, Shift telemetry, and handoffs before applying your policy.

Instructor accounts are verified before they can create classes, view rosters, or assign shifts. Students in an active class owned by a verified instructor receive full-platform access.

Ask about instructor access

Start at any station.

Open free tools

Ten consoles, every drill, no account.