CyberLabs
RR CYBERLAB • PRACTICAL CYBERSECURITY GUIDES

Learn Today. Investigate Tomorrow.

Use these detailed guides as the destination behind the RR CyberLabs daily quiz. Each topic starts with the core idea, then moves into analyst thinking, evidence, examples, common mistakes and a daily quiz hook.

GRC BEGINNER GUIDE Learn how governance, risk and compliance connect everyday security work to clear ownership, controls and evidence. Start the GRC guide → · Try the local risk register
RR CYBERLAB • BEGINNER LEARNING PATH

Start at Step 1. Follow the path to the final mission.

Each step builds on the one before it. Learn how networks and operating systems work, practice reading evidence, then move into investigations, defense, and authorized ethical hacking.

Begin Step 1
01

Network foundations

Understand how devices address, route, and exchange traffic.

  1. IP addresses and subnetsIdentify hosts and the networks they belong to.
  2. OSI layers and packet readingFollow a packet through the layers and learn what each header tells you.
  3. TCP vs UDPLearn the two transport patterns you will see in traffic.
  4. Ports and firewallsConnect services, ports, and filtering decisions.
  5. DNS investigationSee how names become connections and where to look for clues.
  6. HTTP vs HTTPSUnderstand web requests, encryption, and visible metadata.
  7. Traffic direction and network zonesRecognize perimeter traffic and movement inside a network.
02

Operating system basics

Learn the Windows and Linux events that describe users, processes, and changes.

  1. Windows sign-in events 4624 and 4625Distinguish successful and failed logons.
  2. Windows logon typesAdd context to how a user or service signed in.
  3. Windows process creationRead process, parent process, and command-line evidence.
  4. New Windows servicesInvestigate service installation and persistence clues.
  5. PowerShell investigationPut command activity in its user, process, and network context.
  6. Linux users, groups, and permissionsUnderstand accounts, privilege, ownership, and access.
  7. Linux processes and servicesInspect what is running and how it starts.
  8. Linux authentication and SSHReview remote access and authentication evidence.
03

Security monitoring essentials

Move from raw activity to useful alerts and endpoint/network visibility.

  1. Event vs alert vs incidentLearn the stages between an observation and a response.
  2. Log analysis and evidenceBuild a reliable timeline from records across systems.
  3. How SIEM creates alertsSee how collected logs and detection rules form a signal.
  4. SOC operations and alert triageUse a repeatable process to assess and prioritize alerts.
  5. EDR fundamentalsUnderstand endpoint telemetry and investigation pivots.
  6. NDR fundamentalsLearn what network monitoring can reveal.
  7. XDR correlationConnect endpoint, network, and identity evidence.
  8. EDR vs NDR vs XDRCompare the visibility each approach provides.
04

Investigate common signals

Practice asking what happened, who was involved, and what the evidence proves.

  1. Authentication investigationCorrelate account, device, source, and timing.
  2. Investigate a suspicious loginValidate sign-in context before deciding what it means.
  3. Brute force vs password sprayingRecognize different failed-login patterns.
  4. Phishing and IOC investigationTrace a reported message into related evidence.
  5. Suspicious network connectionsAssess unexpected destinations and connection behavior.
  6. Suspicious DNS and beaconingCheck unusual DNS patterns and repeated timing.
  7. Lateral movement and SMBInvestigate host-to-host activity within a network.
05

Threat thinking and response

Use frameworks carefully, improve detection, and carry investigations through response.

  1. Cyber Kill Chain and ATT&CK foundationDescribe attack progression and common behaviors.
  2. MITRE ATT&CK fundamentalsMap observed evidence to tactics and techniques.
  3. Threat hunting fundamentalsTurn a question into evidence-led searches.
  4. False positives and detection tuningImprove useful coverage while checking benign explanations.
  5. Incident response: triage to recoveryUnderstand containment, recovery, and follow-up.
  6. Full alert-to-incident investigationBring the earlier skills together in one case.
06

Ethical hacking and safe practice

Apply your knowledge only with permission, defined scope, and safe targets.

  1. Ethical hacking: authorization to reportingLearn the responsible assessment workflow after building the foundations.
Ready to practice?Try a guided investigation in the Mission Simulator →Explore simulated network incidents in AttackMap Lab →

All examples and practice environments are for learning. Only test systems you own or have explicit permission to assess.

NEW / INTERACTIVE LEARNING TOOL

Choose a case. Follow the evidence. Make the call.

Step into a safe fictional investigation with Guided or Free Explore mode, a safe Linux-style terminal, fictional DNS and endpoint evidence, analyst perspectives, scoring and a final incident report.

Open the Mission Simulator →
01 · The Quiet Beacon02 · Web Application Breach03 · Insider Threat04 · Ransomware Attack05 · The Look-Alike Login06 · The Open Storage Trail07 · The Untrusted Update08 · The Sideways Session
PLAYABLE LEARNING / TWO GAMES

Cyber Chess + SOC Showdown

Switch roles and defend a home setup or organization in Cyber Chess. Then investigate fictional alerts, follow evidence, and make triage decisions in SOC Showdown.

Play the Cyber Games →
Cyber Chess: attacker and defender turnsHome and organization scenariosSOC Showdown: evidence-led triageFictional, local-only simulations
FEATURED FOUNDATION GUIDE

What is ethical hacking?

Learn authorization and scope, reconnaissance, footprinting, scanning, enumeration, vulnerability assessment, safe validation, reporting and defense through original educational material.

Read the ethical hacking guide →
Original learning contentCEH-inspired topic coverageIndependent educationNo official certification claim
NETWORK FOUNDATIONS / INTERACTIVE GUIDE

Read packets and follow OSI encapsulation

Step through Ethernet, IP, TCP/UDP and application data; inspect fictional packet samples and learn how TTL and TCP options can provide cautious OS clues.

Open the packet-reading guide →
OSI encapsulation walkthroughTCP, UDP, DNS and TLS samplesLow-confidence OS fingerprinting cluesNo live packets or probes
DAILY QUIZ → DETAILED GUIDE

Post a short topic and question on Facebook or Instagram. After the answer, send viewers here to learn the technical details. This keeps the social content engaging while the website becomes the deeper learning destination.

Browse the complete guide library

Use search to find a guide directly, or follow the numbered beginner path above from the first step to the final mission.

Cybersecurity Fundamentals

How to Start Learning Cybersecurity: A Practical Beginner's Guide

A practical beginner's guide covering cybersecurity fundamentals, networking, Windows, Linux, security concepts and hands-on learning.

Best for: Beginners starting their cybersecurity learning journey.

Read beginner's guide →
Security Fundamentals

SIEM vs EDR vs NDR: A Beginner's Guide

Understand the differences between centralized security monitoring, endpoint detection and network detection — and how these technologies work together.

Best for: Beginners learning how SIEM, EDR and NDR support security teams.

Read detailed guide →
Frameworks

Cyber Kill Chain & MITRE ATT&CK Foundation

Understand attack progression, ATT&CK tactics and techniques, framework mapping and practical investigation.

Best for: Daily quiz topics, SOC fundamentals and threat-detection learning.

Read foundation guide →
Networking

IP Addresses & Subnets

IP addressing, CIDR and practical security investigation.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Networking

TCP vs UDP

Transport protocols and what analysts should look for.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Network Security

DNS Investigation

DNS requests, anomalies and investigation pivots.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Networking

HTTP vs HTTPS

Web traffic, TLS and what remains visible to analysts.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Network Security

Common Security Ports & Firewalls

Ports, protocols and firewall investigation context.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Network Security

Network Traffic Investigation: North-South vs East-West

Traffic direction, zones and internal movement.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Windows Security

Windows Event ID 4624 & 4625

Successful and failed Windows authentication events.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Windows Security

Windows Logon Types

Context for Windows authentication sessions.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Windows Security

Windows Event ID 4688 & Process Creation

Process creation, parent-child relationships and command lines.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Windows Security

Windows Event ID 7045 & New Services

New Windows services and investigation context.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Windows Security

PowerShell Investigation

PowerShell process, identity and network investigation.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Linux Security

Linux Authentication & SSH Investigation

Linux authentication and SSH evidence.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Linux Security

Linux Processes & Services

Host process and service investigation.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Linux Security

Linux Users, Groups & File Permissions

Identity, privilege and permissions.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
SOC Operations

SOC Operations & Alert Triage

A repeatable SOC alert workflow.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
SOC Operations

Event vs Alert vs Incident

How raw events become alerts and incidents.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
SOC Operations

Log Analysis & Evidence

A practical method for timeline-based log analysis.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
SIEM

How SIEM Turns Logs Into Security Alerts

SIEM ingestion, correlation and detection logic.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
SOC Investigation

Authentication Investigation

A cross-platform authentication investigation workflow.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
SOC Investigation

Phishing & IOC Investigation

Email, IOC and endpoint correlation.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Endpoint Security

EDR Fundamentals

Endpoint telemetry and investigation.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Network Security

NDR Fundamentals

Network visibility and behavior analysis.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Detection & Response

XDR Correlation

Cross-source investigation context.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Detection & Response

EDR vs NDR vs XDR

Compare endpoint, network and cross-domain visibility.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Network Investigation

Suspicious Network Connections

Unexpected destinations and connection patterns.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Threat Detection

Brute Force vs Password Spraying

Authentication attack patterns and detection.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Threat Detection

Suspicious DNS & Beaconing

DNS anomalies and periodic communication.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Threat Detection

Lateral Movement & SMB Investigation

Internal SMB behavior and lateral movement context.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Detection Engineering

False Positives & Detection Tuning

Improve detections without losing coverage.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
MITRE ATT&CK

MITRE ATT&CK Fundamentals

Tactics, techniques and evidence-based mapping.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Incident Response

Incident Response: Triage to Recovery

Structured incident response.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Threat Hunting

Threat Hunting Fundamentals

Hypothesis-driven threat hunting.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
Incident Investigation

From Alert to Incident: Full Investigation

A complete correlated investigation timeline.

Best for: Daily quiz follow-up, analyst learning and practical investigation.

Read detailed guide →
LEARN • PRACTICE • INVESTIGATE • DEFEND

RR CyberLabs is designed around practical cybersecurity learning: understand the concept, inspect the evidence, correlate the activity, document the finding and improve detection.