Crumble SOC Lab

The Wazuh course lab, in your browser

A simulated Wazuh 4.14 server for the Crumble & Co. course: dashboard, SSH terminal, the crumble-sim log simulator with the 65-minute storyline, and a Windows laptop for the agent. Nothing to install: use it when the course VM does not run on your laptop.

Open the lab Read lab 00 (web edition) first

Lab 01 · Onboarding

Agent groups, deploy the Windows agent, FIM, the nine simulated log sources, syslog.

Lab 02 · Log analysis

Discover and DQL on the archives: Bronze, Silver and Gold hunting questions on the storyline.

Lab 03 · Detection engineering

Decoders, rules, CDB lists and correlation rules with wazuh-logtest, exactly as on a real manager.

Lab 04 · Capstone

Detection pack, SOC dashboard with visualizations, incident report.

Good to know

Use a current Chrome, Edge, Firefox or Safari on a laptop or desktop. Log in with admin / admin.
Your work is stored in this browser only. Use Export progress (avatar menu, top right) to keep a copy or to continue on another computer.
The storyline runs in real time (about 65 minutes); the clock in the header can speed it up (10×, 60×) or jump ahead.
The labs are the same as for the VM; each one starts with a short note for the web edition. The lab guide is built into the app.

Reset everything in this browser: delete all saved lab data.