Realistic SOC workflow
Move from alert to evidence, investigation, conclusion and escalation using a repeatable analyst process.
Independent project · Active development
CAERRealistic SOC training.
Know the company.
Investigate what changes.
Practical security investigations inside a persistent simulated organisation. Being built to help aspiring analysts gain experience before their first cybersecurity role.
- STATUS In active development
- MODEL A living organisation
- FOCUS Beginner-first practice
CAER / Analyst workspace
Website preview
Investigation
INV-2026-0042
Sample shift 03
High
Suspicious process activity
PowerShell opened an external connection
FIN-PC-01 · theo.walker · Finance
- Document openedWINWORD.EXE · Finance endpoint
- Child process startedpowershell.exe · hidden window
- DNS query recordedfiles-review.example
- Outbound connection198.51.100.42:443 · 48.2 KB sent
Synthetic training data. Preview of the intended experience, not the finished CAER application.
The CAER simulation model
Employees
Endpoints
Identity
Network
Investigations
The living organisation
The organisation itself becomes the curriculum.
Return to the same fictional people, systems and business activity. Learn what is normal, remember earlier cases and use that knowledge when something changes. That is the intended CAER experience.
Departments
FinanceSimulated users
OperationsSimulated users
PeopleSimulated users
Persistent company
Telemetry
EndpointActivity stream
IdentitySign-in activity
NetworkConnection activity
-
01
Learn the baseline
Build familiarity with normal users, assets and activity instead of starting from zero every time.
-
02
Investigate the signal
Move between alert, endpoint, identity and network evidence using a consistent analyst workflow.
-
03
Make the judgement
Record what happened, explain why it matters and close or escalate the case with confidence.
Why persistence matters
Familiarity becomes evidence.
Rather than resetting all context for every case, CAER is designed so learners can recognise what is normal before deciding what is suspicious. The environment and its activity are synthetic training data.
- 01 Normal users
- 02 Departments
- 03 Devices
- 04 Hostnames
- 05 Expected network behaviour
- 06 Common processes
- 07 Normal authentication patterns
- 08 Business context
Intended learner workflow
A shift, not a disconnected exercise.
CAER aims to carry investigation outcomes into company history, so every return builds on what you already know.
- 01 Understand the company
- 02 Triage and investigate
- 03 Record the evidence and judgement
- 04 Return with more context
Building CAER
A real product in active development.
Working foundations, active development and future plans are kept separate. The website preview illustrates the intended experience; it is not a release of the application.
Status scope: “Prototype / Implemented” refers to foundations in CAER’s private build. The website demonstration uses a separate, fixed sample dataset and does not establish product readiness.
Prototype / Implemented
Working foundations and demonstrated product flows.
- Persistent simulated-company foundation
- Structured fictional employees and users
- Departments and job roles
- Endpoint and device information
- Hostnames and IP/network information
- SOC-style alerts and security events
- Investigation workflow
- Event and evidence inspection
- Investigation progress
- Case conclusions
- Escalation and closure decisions
- Connected telemetry, detection and correlation foundations
In development / Expanding
Areas being deepened and refined in the private build.
- Richer simulated activity and telemetry
- More varied security scenarios
- Deeper user, endpoint, identity and network relationships
- Investigation realism
- Learning assistance and contextual guidance
- Broader scenario and evidence variety
- Application and user-experience refinement
Planned
Intended direction, not functionality available today.
- Expanded training progression
- More sophisticated and noisy environments
- False positives and ambiguous investigations
- Multiple and overlapping incidents
- Larger scenario library
- Production packaging and distribution
- Public release when CAER is ready
CAER is currently in active development. It is not yet publicly downloadable or purchasable, and there is no public early-access programme. Development is private; CAER will be released publicly when it is ready. No release date has been announced.
Read development updates
Interactive analyst preview
Context first. Evidence next. Then a decision.
Explore three sample alerts inside one fictional company. Review its normal behaviour, inspect events and document a judgement. This is a website demonstration of the intended product experience.
CAERAnalyst workspaceNorthstar ComponentsFictional organisation · Sample shift 03
Handover: Finance closes its reporting cycle today. Operations runs a scheduled backup. A new remote sign-in needs context.
Observed timeline
Case record
Preview session onlyWhat this shows: the intended context-led workflow, evidence inspection, guidance levels and reasoned case decisions.
What it is not: a connection to CAER’s private simulation engine, a public trial or a promise of final features.
New to SOC work? Key terms
- SOC
- A security operations centre: a team that monitors and investigates potential security problems.
- Telemetry
- Recorded activity from devices, identity systems and networks.
- Baseline
- The activity normally expected from a person, device or service.
- Correlation
- Connecting related signals without assuming they prove the same incident.
Four planned learning levels
The same environment grows with you.
Guided, Assisted, Analyst and Advanced all use the same simulated company. Support steps back as you learn its normal users, endpoints, departments and network behaviour over time.
One environment: progress comes from deeper judgement, not from starting a disconnected exercise each time.
Progression model
Planned / in development
The interface demonstrates the intended progression. These are not four publicly available products or disconnected exercise sets.
01
Planned level · Guided
Learn what every field means.
Clear explanations, terminology and sensible next steps stay beside the investigation while you build your first repeatable workflow.
- Field-level explanations
- Suggested investigation order
- Recoverable decisions
Why CAER?
Practice built around judgement, not answer-guessing.
CAER’s design principles keep the experience realistic enough to matter and clear enough for new analysts to learn safely.
Persistent organisational context
Learn the same fictional people, systems and normal behaviour so anomalies become meaningful rather than pre-labelled answers.
Follow evidence, then decide
Inspect signals, correlate activity and explain a conclusion instead of trying to guess what an exercise expects.
Support that steps back
Guidance is intended to reduce gradually while the underlying company and investigation process stay familiar.
Beginner accessibility
Plain language, predictable navigation and progressive disclosure help learners focus on the security work itself.
Safe cybersecurity practice
Work with synthetic organisations, identities and activity inside an educational simulation built for authorised learning.
Learn from mistakes
Revisit guidance, reconsider a judgement and understand what changed without unnecessary punishment or lost progress.
Build practical judgement
Repeated decisions in a familiar environment are intended to turn theory into a more confident investigation process.
“Give people somewhere safe to gain the experience employers keep asking for before they’ve had a chance to get the job.”
The CAER mission
Built for people trying to get their first real chance. CAER is an independent project currently in active development.
Independent project
Support CAER
CAER is currently an independent project. Optional contributions help cover development, hosting, infrastructure and tooling while the platform is being built.
Follow the build
CAER is becoming a real platform.
Follow development updates, see new investigations take shape and get in touch if the mission speaks to you.