Guided investigations
Six cases cover email security, identity, endpoint activity, data access, detection tuning, and incident handover. Inspect evidence, make decisions, use the notebook, and export a practice report.
Enter the training workspace ↗Project / Lighthouse SOC · Live browser training
Lighthouse SOC
From an incoming signal to an evidence-led next action.
A practical learning project by Richard Fisher for people developing junior analyst investigation and handover skills.
The problem
An alert is only the beginning.
Practising security operations means more than recognising a suspicious signal. An analyst needs to establish scope, test an explanation against the evidence, decide what happens next, and make the reasoning useful to someone else.
Lighthouse makes that sequence visible through guided investigations and a separate role-based incident simulation.
- Read the briefing
- Inspect the evidence
- Make a decision
- Document a handover
- Review the reasoning
What you can try
Two ways to practise.
Incident simulator
Switch between reporter, analyst, and SOC lead views. Submit a fictional signal, inspect enrichment and priority, record response decisions, and review the incident history.
Try the role workflow ↗Implementation
Built to inspect and explain.
Browser experience
React and Vite provide the training app and browser simulator. Practice progress is stored locally on the device. The public demo requires no account and does not connect to a live security environment.
Original incident application
The Python and Streamlit application uses SQLite, synthetic seed records, rule-based priority scoring, and an incident lifecycle. Its source includes automated tests, architecture diagrams, and a threat model.
Assumptions & boundaries
Practice, with clear limits.
- All cases and evidence are synthetic. Use fictional information in the simulator.
- Browser role switching is a practice feature, not authentication or an access-control boundary.
- Progress is device-local; it does not sync across devices and may be lost if browser storage is cleared.
- Decision feedback supports learning. Written handovers use an example and self-review checklist; practice scores are not certification.
- Response actions update fictional records only.
Explore the evidence
Try it. Read it. Review the code.
The repository documents setup, automated checks, architecture, and current limitations.
View the project repository ↗