Runtime Defense Lab
Incident Response Simulator
You are on call. Falco fires, Tetragon blocks a syscall, an audit log raises a flag. Each scenario drops you into the first 60 seconds of an incident — the moment between "alert" and "decision". Triage well, contain fast, write the post-mortem.
6 scenarios~15 minutesHard
Hard
How the simulator works
- Each scenario shows a Falco rule firing, an audit-log line, or a runtime telemetry event from a real cluster.
- Choose the right next action — the wrong answers explain why they look reasonable but waste critical time.
- Read the production explanation, follow the link to the deeper lesson, and move to the next scenario.
- Score yourself across all six rounds — covering shell-in-container, lateral movement, crypto-mining, container drift, audit-log triage, and eBPF-detected fileless attacks.