Defender XDR series · five advanced labs · 500 points
Five console-replica labs built for people who already know where the alert queue is. Each one drops you into a simulated tenant at a fixed clock, gives you synthetic telemetry you can actually query, and refuses the shortcut — the hard delete before the export, the tenant-wide allow list, the unbounded hunt, the report that calls an indicator confirmed when it is still pending.
Built by Pradeep Raju, founder, RCW IT Training · labs written from real shift practice, run entirely in your browser.
Work them in order if you want the narrative to build; skip straight to the one that matches your gap. Every lab states its own objective list, marking table and answer expectations inside the Lab guide view.
A correlated incident reaches the queue nine days from its SLA: PowerShell under a delivered link, a startup rule, a mailbox forwarding rule. You claim it, prove the story, bound the blast radius and close it honestly.
One workstation, a signed binary doing information gathering, a beacon, and the same file hash on three hosts. Scope it, read the process tree, then run live response so the evidence survives the session.
A service account logs on at the wrong hour, ten children appear on one device, and the beacon has one jittered interval you must not average away. You write the queries — a real KQL engine runs them in your browser — then turn the finding into a detection and a suppression that expires.
Night shift, on-premises Active Directory: Kerberoasting, a DSync enquiry, a four-minute clock skew on a domain controller and a honeytoken that finally spoke. The graph shows possibility; you have to prove which edge was walked and cut it in the right order.
Friday 09:00. One reported mail, eleven delivered, four clicked, two credential posts, a forward-and-delete inbox rule, and a detection that was overridden by a tenant rule. Scope it, remediate it in an order that keeps the evidence, then write the record a regulator could read.
Why these labs look like the console but never pretend to be it, what data they may contain, how the scoring works, and how accessibility is verified rather than claimed.
The same eight rules apply to all five. They are what makes the practice transferable to a real shift without the lab pretending to be vendor software.
contoso-rcw.example. Reserved example domains for addresses, documentation ranges for IPs, invented message IDs and hashes. Nothing here came out of anyone’s environment.localStorage in your browser and nowhere else. The audit log is local, redacts identities by default, and is only shared if you export and send it yourself.shared/kql-lite.js executes your query against the same tables the answer key was derived from, so bounds, joins, projections and aggregates are verified — not pattern-matched.Not certification preparation. These labs practise judgement on synthetic data. They do not follow an exam outline, do not award credit, and are not affiliated with or endorsed by Microsoft. Product names are used to teach the workflow.