SOC LOG LAB / TRAINING DATA
Small synthetic log drills.
Ready in your browser.
Choose a log family, row count, positive-finding count, difficulty, and private trainer seed. Download portable analyst logs and a separate answer key—no setup, account, upload, or backend.
SET UP A DRILL
Choose your dataset
Total analyst rows120
Planted findings5
Difficulty additions2
Preview rule: planted findings = min(total rows, base positives + difficulty − 1). Higher tiers add one finding each, then increase linked-event context and signal subtlety.
ANALYST VIEW
Log preview
Previewing the first rows only. The answer key is a separate file.
Reveal the answer key in this browser
Keep this closed when sharing the screen with an analyst. The download remains a separate file.
Format and safety notes
- Linux options export raw, RFC 5424-shaped syslog text plus JSONL. They are synthetic examples, not a promise of any distribution’s exact defaults.
- Sentinel output resembles documented Syslog table field names; CrowdStrike is CPS/ECS-inspired; Rapid7 is generic syslog training JSON. All are labeled training-only and are not official export schemas.
- No actual credentials, malware, real domains, or routable indicators are included. Do not treat synthetic rows as threat intelligence or use them to test production detections without review.
- Nothing is stored by the app. The browser may retain downloads in your chosen location; exported files are not encrypted.