Awesome-Splunk-and-Elastic-SIEM-Practice-Labs - GitLite

KO | EN

gitlite — search

#python #ai #typescript #llm #golang #android #machine-learning #deep-learning #linux #docker #kubernetes #awesome-list #mcp #openai

Awesome-Splunk-and-Elastic-SIEM-Practice-Labs

(★ 66)

This repository dedicated to collect SIEM practice labs (Splunk and Elastic) from various cybersecurity training platforms

Awesome-Splunk-and-Elastic-SIEM-Practice-Labs 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Awesome Splunk and Elastic SIEM Practice Labs
Table of contents
- [Splunk](#splunk)
- [Elastic (ELK)](#elastic)
- [Elastic or Splunk, your choices](#elastic-or-splunk-your-choices)
* * *
📝 A list of labs with Splunk and Elastic from various CyberSecurity Training platforms such as [CyberDefenders](https://cyberdefenders.org/dashboard/), [BlueTeamLabs Online (BTLO)](https://blueteamlabs.online/), [TryHackMe](https://tryhackme.com/), [DFIR Labs](https://portal.training-thedfirreport.com/store), [Xintra](https://www.xintra.org/), [Ace Responder](https://aceresponder.com), and more (will be updated in the future)!

💬 Remark

Meaning of each Symbol in AD column:
- ✅ — The lab involves an **Active Directory environment**.
- ❌ — The lab is **not part of an Active Directory environment** or AD is present but **not significantly involved** (e.g., no domain interactions or lateral movement).
- *(Blank)* — Not confirmed whether the lab uses Active Directory (have not reviewed them yet).

## Splunk
|Lab Name|Platform|Difficulty|Pricing|Lab Link|AD|
|-|-|-|-|-|-|
Spilled Bucket|BTLO|Easy|Subscription|[Link](https://blueteamlabs.online/home/investigation/spilled-bucket-21784640e3)|❌
AWeSome|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/awesome-1c301a0441)|❌
DomainNance|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/domainnance-befa8a1fd4)|✅
Nika-AD|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/nika-ad-826478c8a5)|✅
Splunk IT|BTLO|Easy|Subscription|[Link](https://blueteamlabs.online/home/investigation/splunk-it-0aae63055a)|✅
Drilldown|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/drilldown-db9ea241de)|❌
Pikaboo|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/pikaboo-6bcb02f1a9)|✅
MiddleMayhem|BTLO|Easy|Free|[Link](https://blueteamlabs.online/home/investigation/middlemayhem-aa3c27f5d1)|❌
Rotten Cloud|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/rotten-cloud-dcf4ab87e0)|❌
Bad Import|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/bad-import-f97ef9bc96)|❌
ShadowRoast|CyberDefenders|Meidum|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/shadowroast/)|✅
FalconEye|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/falconeye/)|✅
Boss Of The SOC v1|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/boss-of-the-soc-v1/)|❌
Boss Of The SOC v2|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/boss-of-the-soc-v2/)|❌
Boss Of The SOC v3|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/boss-of-the-soc-v3/)|❌
AWSRaid|CyberDefenders|Easy|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/awsraid/)|❌
NerisBot|CyberDefenders|Easy|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/nerisbot/)|❌
LNKTrap|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/lnktrap/)|✅
TeamCity Exploit|CyberDefenders|Insane|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/teamcity-exploit/)|✅
Voldemort - APT41|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/maldemort/)|❌
NetSupport RAT - TA569|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/shadowcitadel/)|✅
CredSnare - Angry Likho APT|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/credsnare/)|✅
Zoom Incident - Ignoble Scorpius APT|CyberDefenders|Insane|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/doom/)|✅
StarkTech Incident - APT41|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/doubledragon/)|✅
Nitrogen - Blackcat Ransomware|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/nitrogen/)|✅
BlackSuit APT Breach|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/blacksuitbreach/)|✅
RansomHub|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/ransomhub/)|✅
Latrodectus – LunarSpider|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/latrodectus-lunarspider/)|✅
Raining Dinosaurs - Storm-2603|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/raining-dinosaurs-storm-2603/)|✅
Stolen Time - HiddenTear|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/stolen-time-hiddentear/)|✅
Poisoned PyTorch|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/poisoned-pytorch/)|✅
MarkShell - TA577|CyberDefenders|Easy|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/markshell-ta577/)|✅
Benign|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/benign)|❌
PS Eclipse|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/posheclipse)|❌
New Hire Old Artifacts|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/newhireoldartifacts)|❌
Investigating with Splunk|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/investigatingwithsplunk)|❌
Conti|TryHackMe|Medium|Free|[Link](https://tryhackme.com/room/contiransomwarehgh)|❌
Brains|TryHackMe|Easy|Subscription|[Link](https://tryhackme.com/room/brains)|❌
Splunk 2|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/splunk2gcd5)|❌
Splunk 3|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/splunk3zs)|❌
Fixit|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/fixit)|❌
Volt Typhoon|TryHackMe|Medium|Free|[Link](https://tryhackme.com/room/volttyphoon)|✅

## Elastic
|Lab Name|Platform|Difficulty|Pricing|Lab Link|AD|
|-|-|-|-|-|-|
SOC Alpha 1|BTLO|Easy|Subscription|[Link](https://blueteamlabs.online/home/investigation/soc-alpha-1-2ba4c4a550)|❌
SOC Alpha 2|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/soc-alpha-2-f3825dedc4)|❌
SOC Alpha 3|BTLO|Hard|Subscription|[Link](https://blueteamlabs.online/home/investigation/soc-alpha-3-cfb2546607)|❌
Cozy Bear|BTLO|Hard|Subscription|[Link](https://blueteamlabs.online/home/investigation/cozy-bear-bffa6a1614)|
Cozy Bear 2|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/cozy-bear-2-ac16cb3101)|✅
PE|BTLO|Easy|Subscription|[Link](https://blueteamlabs.online/home/investigation/pe-d567ae3ed5)|❌
Gothic Panda 2|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/gothic-panda-2-71eeb94c31)|
Defaced|BTLO|Easy|Subscription|[Link](https://blueteamlabs.online/home/investigation/defaced-593f17897e)|❌
Rigged|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/rigged-81bc67b3e7)|❌
Peak|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/peak-98765b84cb)|❌
Invoice|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/invoice-593671201f)|❌
Bada Breach|BTLO|Hard|Subscription|[Link](https://blueteamlabs.online/home/investigation/bada-breach-a476f8b6bf)|✅
Pathfinder's Mark|BTLO|Medium|Subscription|[Link](https://blueteamlabs.online/home/investigation/pathfinders-mark-40f725ed70)|❌
Dumpster|BTLO|Hard|Subscription|[Link](https://blueteamlabs.online/home/investigation/dumpster-303c7fec88)|✅
AzureHunt|CyberDefenders|Easy|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/azurehunt/)|❌
ElasticCase|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/elasticcase/)|❌
GitTheGate|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/gitthegate/)|❌
PaloAltoRCE|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/paloaltorce/)|❌
HafinumAPT|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/hafinumapt/)|❌
LTE Fallen Wall|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/lte-fallen-wall/)|❌
Maromafix Falldown - RansomHub|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/maromafix-falldown-ransomhub/)|✅
Slingshot|TryHackMe|Easy|Subscription|[Link](https://tryhackme.com/room/slingshot)|❌
ItsyBitsy|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/itsybitsy)|❌
Boogeyman 3|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/boogeyman3)|✅
Hunt Me I: Payment Collectors|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/paymentcollectors)|❌
Hunt Me II: Typo Squatters|TryHackMe|Medium|Subscription|[Link](https://tryhackme.com/room/typosquatters)|✅
Virus Vipers|XINTRA|Medium|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-5)|
Assassin Kitty|XINTRA|Hard|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-6)|✅
Waifu University|XINTRA|Easy|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-7)|✅
Husky Corp|XINTRA|Medium|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-10)|✅
TechTonik Inc|XINTRA|Hard|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-11)|
Airbuzzed|XINTRA|Medium|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-12)|
Council of Tropical Affairs|XINTRA|Medium|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-38)|✅
Abu Jibal|XINTRA|Medium|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-37)|✅
AB Projekt Blue|XINTRA|Medium|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-35)|❌
Meow Islands|XINTRA|Hard|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-39)|
NavalTech Systems|XINTRA|Medium|Subscription|[Link](https://www.xintra.org/dashboard/upgrade?ref=lab-40)|
Acquisition|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/acquisition)|
Pipe Dream|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/pipedream)|
AD Maze|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/ad-maze)|
Qakbot|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/qakbot)|
Blind Spot|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/blind-spot)|
Pwned 365|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/pwned-365)|
Pivot|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/pivot)|
Under Pressure|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/under-pressure)|
Airgapped|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/airgapped)|
Unassumed Breach|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/unassumed-breach)|
Volt Typhoon|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/volt-typhoon)|
Run of the Mill|Ace Responder|None|Free|[Link](https://aceresponder.com/challenge/run-of-the-mill)|
Locked Up|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/locked-up)|
Intune Infiltration|Ace Responder|None|Subscription|[Link](https://aceresponder.com/challenge/intune-infiltration)|

## Elastic or Splunk, your choices
|Lab Name|Platform|Difficulty|Pricing|Lab Link|AD|
|-|-|-|-|-|-|
BumbleSting|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/bumblesting/)|✅
GoldenSpray|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/goldenspray/)|✅
Kerberoasted|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/kerberoasted/)|✅
T1197|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/t1197/)|❌
Midnight RDP|CyberDefenders|Hard|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/midnight-rdp/)|✅
Ignoble Scorpius|CyberDefenders|Insane|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/ignoble-scorpius/)|✅
T1110–003|CyberDefenders|Easy|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/t1110003/)|❌
REvil|CyberDefenders|Easy|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/revil/)|❌
Black Basta|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/black-basta/)|✅
Perfect Survey|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/perfect-survey/)|✅
Rhysida - Vice Society|CyberDefenders|Medium|Subscription|[Link](https://cyberdefenders.org/blueteam-ctf-challenges/rhysida/)|✅
BlueSky Ransomware - Public Case #19208|DFIR Labs|Easy|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|
ALPHV Ransomware - Public Case #24952|DFIR Labs|Easy|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅
A Truly Graceful Wipe Out - Public Case #21619|DFIR Labs|Easy|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅
NetSupport Intrusion Results in Domain Compromise - Public Case #19438|DFIR Labs|Medium|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅
Qbot Leads to Domain Compromise - Private Case #27101|DFIR Labs|Medium|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅
Dagon Locker Ransomware - Private Case #23825|DFIR Labs|Hard|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|
LockBit Ransomware - Public Case #27244|DFIR Labs|Medium|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅
Backdoors and LockBit - Private Case #27138|DFIR Labs|Easy|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅
BlackSuit Ransomware - Public Case #29354|DFIR Labs|Hard|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅
Elpaco-Team Ransomware - Private Case #30043|DFIR Labs|Medium|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅
Mud In The Water - Private Case #29823|DFIR Labs|Hard|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|
RansomHub Leads to Domain Compromise – Private Case #33490|DFIR Labs|Hard|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅
The Hive Ransomware Fail - Public Case #18364|DFIR Labs|Easy|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|
The Nokoyawa Ransomware Intrusion - Public Case #18543|DFIR Labs|Easy|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|
Specter's Domain Heist - Private Case #35218|DFIR Labs|Hard|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|
The Lunar Tangled Malware Web - Public Case #28761|DFIR Labs|Hard|Pay per access|[Link](https://portal.training-thedfirreport.com/store)|✅

***