CYBRARY Forge Exercises
Live team incidents with roles, handover and a facilitator.
What is in it
For soc manager, incident response lead — rehearse a coordinated response and see how the team actually behaves.
- Shared persistent estate: everyone sees the same state at the same time
- Role gating, lobby, shift handover notes and typing and read receipts
- Facilitator view with injects, pause, help flags and a technical debrief
- Business impact tied to the technical work
What it is not
- Facilitation as a service is scoped separately from the platform
- Concurrency beyond the tested profile needs a load acceptance first
Forge Exercises against the field
20 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: Cyberbit, RangeForce DRILL, Immersive, TryHackMe Live Breach.
- Shared persistent state: what one responder changes, the rest of the team sees, including handover notes and read receipts.
- The facilitator can inject, pause and flag mid-exercise without rebuilding anything.
- Business impact is graded alongside the technical work.
| What you need | Forge ExercisesIncluded in the platform | THM | RangeForce | Cyberbit | Immersive |
|---|---|---|---|---|---|
| Multi-machine technical scenarios | Yes See it live | TryHackMe: Documented for Multi-machine technical scenarios | RangeForce: Documented for Multi-machine technical scenarios | Cyberbit: Documented for Multi-machine technical scenarios | Immersive: Documented for Multi-machine technical scenarios |
| Genuine operating-system and native target executionThe clearest competitor advantage in the whole register. | Coming Deliberate design, and the trade is worth reading: because nothing real executes, a range opens in seconds, is disposable between runs and carries no infrastructure to patch, isolate or clean up. A declared native lane is the bridge for the cases that genuinely need real execution; until it ships we do not claim this. | TryHackMe: Limited for Genuine operating-system and native target execution | RangeForce: Documented for Genuine operating-system and native target execution | Cyberbit: Documented for Genuine operating-system and native target execution | Immersive: Documented for Genuine operating-system and native target execution |
| Disposable, zero-risk practice environmentsNo VM to provision, isolate or rebuild — a fresh estate every run, with nothing real to break. | Yes See it live A range opens in seconds in the browser, resets to a clean state on every run and costs nothing to stand up or tear down — so practice is frequent instead of scheduled around infrastructure. | TryHackMe: Limited for Disposable, zero-risk practice environments | RangeForce: Limited for Disposable, zero-risk practice environments | Cyberbit: Limited for Disposable, zero-risk practice environments | Immersive: Limited for Disposable, zero-risk practice environments |
| Delivered entirely in the browser | Yes See it live No VM to provision, so a lab opens in seconds rather than minutes. | TryHackMe: Documented for Delivered entirely in the browser | RangeForce: Documented for Delivered entirely in the browser | Cyberbit: Documented for Delivered entirely in the browser | Immersive: Documented for Delivered entirely in the browser |
| Private or isolated practice environments | Yes See it live | TryHackMe: Limited for Private or isolated practice environments | RangeForce: Documented for Private or isolated practice environments | Cyberbit: Documented for Private or isolated practice environments | Immersive: Documented for Private or isolated practice environments |
| Team live-fire response | Yes See it live | TryHackMe: Documented for Team live-fire response | RangeForce: Documented for Team live-fire response | Cyberbit: Documented for Team live-fire response | Immersive: Documented for Team live-fire response |
| Red and blue or adversarial team modes | Yes See it live | TryHackMe: Limited for Red and blue or adversarial team modes | RangeForce: Documented for Red and blue or adversarial team modes | Cyberbit: Limited for Red and blue or adversarial team modes | Immersive: Documented for Red and blue or adversarial team modes |
| Customer-specific technical scenarios | Yes See it live | TryHackMe: Documented for Customer-specific technical scenarios | RangeForce: Limited for Customer-specific technical scenarios | Cyberbit: Documented for Customer-specific technical scenarios | Immersive: Documented for Customer-specific technical scenarios |
| Customer machine-image import | By design, no Requires the native lane. Immersive is the only documented example. | Immersive: Documented for Customer machine-image import | |||
| Facilitated technical exercises | Yes See it live | TryHackMe: Limited for Facilitated technical exercises | RangeForce: Documented for Facilitated technical exercises | Cyberbit: Documented for Facilitated technical exercises | Immersive: Documented for Facilitated technical exercises |
| Business impact linked to technical work | Yes See it live | TryHackMe: Limited for Business impact linked to technical work | RangeForce: Limited for Business impact linked to technical work | Cyberbit: Documented for Business impact linked to technical work | Immersive: Documented for Business impact linked to technical work |
| Learner configures routing and firewall behavior | Yes See it live Routing, switching, wireless and firewall labs where a wrong rule is visible on the wire. | TryHackMe: Limited for Learner configures routing and firewall behavior | RangeForce: Limited for Learner configures routing and firewall behavior | Cyberbit: Limited for Learner configures routing and firewall behavior | Immersive: Limited for Learner configures routing and firewall behavior |
| The same attempt survives refresh and reconnectPublished as a result you can watch run, not as a feature claim. | Yes See it live The attempt is cut at every step and recovered from each one, in your own browser as the page loads. | ||||
| Proof of consistent shared state under concurrency | Yes See it live Forty seats receive the same actions backwards, jumbled, duplicated and after a late join, and all land on one world. | ||||
| Physical and layer-1 equipment faults as graded contentCables, optics, network cards, switch ports, power, cooling, disks, memory, firmware, peripherals and wireless. | Yes See it live Faults planted from a seed, visible in counters, syslog, sensors and on the wire. | ||||
| Escalation graded on reaching the owning departmentA right diagnosis sent to the wrong queue with the wrong evidence scores as wrong. | Yes See it live | ||||
| Editors behave like the real ones, including a write conflictvi, Emacs, nano and pico with regex search, substitution, marks, visual mode, syntax highlighting by file type, and the warning you get when a file is already open elsewhere. | Yes See it live Leaving an editor hands focus back to the shell that launched it, on every terminal — Bash, PowerShell and cmd. | ||||
| Command-line tools parse the real syntax rather than matching fixturessed, awk, grep and cat run genuine engines: BRE/ERE/fixed/PCRE dialects, hold space, branching, labels, BEGIN/END blocks, arrays, printf, redirection and true exit codes. | Yes See it live A wrong flag fails the way it fails on a real box, so a learner cannot pass by typing the expected answer. | ||||
| Wireless, Bluetooth and wide-area links as first-class estateAccess points and SSIDs, paired devices, rooftop bridges, IPSec, WireGuard and MPLS sites with radio and link faults. | Yes See it live | TryHackMe: Limited for Wireless, Bluetooth and wide-area links as first-class estate | Cyberbit: Limited for Wireless, Bluetooth and wide-area links as first-class estate | ||
| Shared network storage that persists across machinesMapped drive letters on Windows, NFS and CIFS mount points on Linux, fstab and mtab, private home drives and discoverable credentials. | Yes See it live What one host writes to a share, another host reads later in the same exercise. |
The run behind this line: The whole breach, with the clocks running
A live team exercise: delivery, identity abuse, lateral movement and a containment decision, all timed against the response plan.
Opponent: Intrusion crew working to a two-hour objective. Shaped after Composite of published hands-on-keyboard intrusions with a recovery phase. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.
How it starts — the message delivered to the mailbox
- From
- Northwind HR <people@northwind-hr.example>
- Subject
- Updated salary bands — confirm your band before Friday
- Link
- shows “Open the review sheet”, really points at https://northwind-hr.example/bands/review?u=%USER%
- A subject engineered for curiosity rather than a task anyone asked for
- A domain that is close to the real one but registered separately
- The link carries the recipient's name, so every click identifies a victim
Graded verdict: phish — T1566.002. Nothing here sends or resolves anywhere real.
The steps, and the zone each one crosses
| # | Tactic | ATT&CK | On the range | IEC 62443 zone |
|---|---|---|---|---|
| 1 | Initial access | T1566.002 Phishing: spearphishing link | The team sees the lure land before the first alert fires. | Enterprise |
| 2 | Credential access | T1558.003 Kerberoasting | Service tickets with weak encryption are pulled for offline cracking. | Identity |
| 3 | Lateral movement | T1021.002 SMB/Windows admin shares | The cracked service account opens admin shares on a second host. | Enterprise |
| 4 | Impact | T1490 Inhibit system recovery | Shadow copies are deleted before anything is encrypted. | Operations DMZ |
Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Identity (Purdue level 4, via LDAP and Kerberos to the domain controllers); Operations DMZ (Purdue level 3.5, via Jump host and historian replication). How the zone model is used.
The alerts the SIEM raises from this run
Service ticket requested with weak encryption
RC4 service tickets for accounts that never interactively log on.
directory audit · stage 2 · LINE-EXERCISES-01 · T1558.003
Admin share opened by a service account
ADMIN$ or C$ opened by an account with no interactive history.
endpoint agent · stage 3 · LINE-EXERCISES-02 · T1021.002
Shadow copies deleted
vssadmin or wbadmin removing recovery points.
backup service · stage 4 · LINE-EXERCISES-03 · T1490
What the case has to hold before it closes
- Time to first alert and time to first containment action
- Every account the crew used and what it was used for
- The hosts touched, in order
- The recovery point chosen and why
Start learning this line
A whole breach end to end, with the clocks running.
Start the lab
A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.