Connecting telemetry, alerts and investigations.
CAER’s private development build now has working foundations that turn activity inside the simulated company into telemetry, detections, alerts and reviewable investigation work.
Earlier work concentrated on the organisation beneath CAER: its employees, departments, roles, devices, identities, access and relationships. The next challenge was turning activity inside that environment into something a SOC analyst can investigate.
A working pipeline can now take simulated activity, produce learner-visible telemetry, process it through detection logic and generate alerts when relevant conditions are met. Detection is not limited to isolated events: sequence rules can recognise related activity across a period of time when several pieces of evidence become more meaningful together.
What has now been connected
- Detection
- Activity from the simulated company can produce telemetry that is evaluated by reusable detection logic and converted into alerts.
- Correlation
- Related alerts can form an incident candidate: a reviewable suggestion that several signals may belong together, not an automatically confirmed incident.
- Review
- The analyst can compare contributing alerts, observable correlation reasons and a combined chronological evidence timeline before making a decision.
- Persistence
- Dismissal and promotion decisions are stored, and later alerts belonging to the same candidate can be attached to the existing investigation.
Keeping the answer out of the interface
An important part of this work is separating what actually happened inside the simulation, what evidence security tools could realistically observe and what the analyst has learned from that evidence. The underlying world may know that two activities are connected, but the learner should only reach that conclusion from information genuinely available to them.
The Incident Review interface is being developed around that separation. It can bring related alerts together, combine and de-duplicate their evidence, identify which alerts contributed each event and let the analyst dismiss the grouping with a reason or promote it into a full investigation.
The platform can maintain a coherent simulated world without quietly revealing the answer to the learner.
The automated backend test suite has reached 149 passing tests, covering an increasing amount of the simulation, detection, correlation and investigation behaviour. This remains private development work rather than a public release.
Next: threats inside the same world
The next major area is the threat simulation system. The intention is for malicious activity to operate against the actual identities, endpoints and systems in the generated company, unfold over time and produce evidence through the same mechanisms as normal activity.
Sometimes that activity should create obvious alerts. Sometimes several weak signals may need to be connected. Legitimate behaviour may also look suspicious, and some malicious activity may eventually go undetected. That uncertainty is central to CAER’s aim of helping learners build practical judgement rather than simply find a pre-labelled answer.