07 / INCIDENT RESPONSE
SOC Incident Response Simulator
Interactive React + Node.js training tool simulating real-world SOC alert triage and incident response with 30+ MITRE ATT&CK-tagged scenarios, scoring, and leaderboard tracking.
Project overview
A full-stack web application designed to build incident response and threat analysis skills through realistic SOC scenarios. Users triage alerts, identify attack patterns, correlate indicators, and recommend containment actions.
Key features
- 30+ Scenarios: Real-world incident types—ransomware, lateral movement, data exfiltration, privilege escalation, supply-chain compromise.
- MITRE ATT&CK Integration: Each scenario tags relevant tactics and techniques (Reconnaissance, Initial Access, Persistence, Defense Evasion, etc.).
- Scoring Engine: Accuracy-based scoring: correct triage (alert classification), proper ATT&CK mapping, and recommended response actions.
- Leaderboard: SQLite backend tracks player scores, response times, and mastery by attack phase.
- Dark Terminal Aesthetic: SOC-authentic styling with live-alert feeds and forensic-style data displays.
Technical architecture
Frontend: React SPA with component-based scenario rendering, real-time score updates, and responsive UI for desktop/mobile SOC dashboards.
Backend: Node.js + Express REST API serving scenario data, validating user responses, computing scores, and persisting leaderboard rankings to SQLite.
Data Model: Scenario definitions include alert context, expected indicators, correct triage classification, MITRE ATT&CK mappings, and grading rubrics.
Learning outcomes
- Recognize incident indicators and attack patterns across stages of the kill chain.
- Map observed behavior to MITRE ATT&CK tactics and techniques.
- Prioritize alerts by severity and business impact.
- Recommend containment and eradication steps aligned to incident type.
- Understand the relationship between technical indicators and attack strategy.
Use cases
- SOC analyst onboarding and continuous training.
- Threat-hunting team skill assessments.
- Incident response playbook validation and refinement.
- Cybersecurity student portfolio demonstration of incident handling knowledge.