SOC Shift Desk
Work one analyst shift: triage, hunt, tune, hand over, then check the key.
Loading the event lake and the rule engine.
Kestrel Ledger SOC is a fictional sample estate. The shift is saved in this browser only.
How it comparesHow it compares
Checked 2026-11-06 against each project's own source and docs. The desk is a training range sized for one shift. A case platform runs a team for years.
| Capability | This desk | TheHive 5 / DFIR-IRIS | Training ranges (BOTS, attack_range, queue labs) |
|---|---|---|---|
| Alert to case, merge alerts into one incident | Yes, verdict links alerts to an incident | Yes, with alert similarity and merge | Queue labs: yes. BOTS: questions, no cases |
| Observables with IOC flag, TLP and PAP | Yes, per observable, TLP 2.0 incl. AMBER+STRICT | Yes | No |
| Tasks and response log | Response actions with owners, pending items carry over | Tasks, task logs, templates, responders | Partial |
| MTTD, MTTA, MTTR | From the shift clock, per alert and incident | TheHive KPIs from alert and case dates | Not measured |
| Answer key and grading | Yes, plus seeded variants with new addresses and IDs | No | Yes, fixed datasets |
| Scale, users, case templates, automation | One analyst, one shift, in the browser | Multi-tenant, RBAC, Cortex analyzers, playbooks (Shuffle) | Full SIEM stack to deploy |
- Known limits: one fictional estate with seeded variants of it, no case templates or custom fields, no multi-analyst assignment. ATT&CK names come from the v19.2 snapshot; v20 is current.
SOC Shift Desk FAQ
What happens in a shift?
You take the APAC shift from 00:00 to 09:00 UTC for Kestrel Ledger, a fictional company. Acknowledge the AMER handover, move the shift clock, and alerts arrive when their condition was met. Record a verdict with a reason for each alert, link true positives to incidents, take response actions, run hunts, file tuning requests and send a handover note to EMEA.
How are the alerts raised?
Seven Sigma rules run on sigma.js, the engine behind the pwnsy Detection Workbench, over EDR, SSE, WAF, IdP and CloudTrail style records. Two multi-step detections are correlations in JavaScript: a credential stuffing burst followed by a successful login from the same network, and one sign-in session used from two networks.
How does the tuning check work?
A tuning proposal adds a filter built from the fields that separate the alerts you closed as false or benign from the ones you confirmed. The rule is then re-run over every event, and the proposal is blocked if it would drop a confirmed true positive.
Which lookups are live?
IP addresses go to RDAP for the network owner and to the pwnsy exit-IP API for the Tor Project exit list. Domains go to Cloudflare DNS over HTTPS and RDAP, npm packages to OSV, and CVEs to the CISA KEV catalogue from CISA's kev-data repository. The npm package ethersscan-api and the two VPS addresses are real, so those lookups return true answers. Every other event is invented.
Can I score my shift?
Yes. The answer key lists the verdict a good shift reaches for every alert and what each hunt should find, and compares it with yours. Send verdicts to Alert Budget turns your closed alerts into per-rule precision and triage load on the Alert Budget page.
Is anything uploaded?
No. Detections, hunts, tuning and the handover run in your browser, and the shift is saved in this browser only. The live lookups send only the indicator you look up.
Every person, host, customer and event belongs to Kestrel Ledger, a fictional company. The npm package ethersscan-api (OSV MAL-2024-8847) and the owners of the two VPS addresses are real so the live lookups return true answers; the activity around them is invented. Documentation ranges stand in for attacker infrastructure. ATT&CK names come from the pinned MITRE ATT&CK v19.2 snapshot used across the detection suite.