SecOps training

Test, train and improve your cyber teams and tools

Enhance your cyber strategy at human and technical levels.
- Train your cybersecurity teams against real threats—no false positives, using real indicators and TTPs.
- Strengthen detection tools with tailored contextualized rules.


1) Launch an attack simulation

Create a campaign utilizing the various scenarios created by the BlackNoise R&D team, tailored to the specific technical scope you aim to address and the offensive behaviors you intend to replicate.
Please refer to steps 1 to 4 on the  ⁠⁠Security validation⁠  page for guidance.
For such use case, we advise you to choose manual execution mode or at least setting a delay if you keep the automatic mode. This will facilitate the analysis of detection behaviors on real time from your defense tools.


2) Identifying indicators of Attack Behaviors

Evaluate detection data from your deployed tools (EDR, NDR, SIEM, honeypots, etc.) for each executed event. The alerts and logs generated contribute to the detection data within the BlackNoise platform, facilitating the consolidation of results.
Utilize the simulation to train the blue team in effectively using the interfaces of detection tools: generating precise alerts, utilizing appropriate dashboards, and constructing queries to search through logs, among other skills.
The simulation also serves as an opportunity to assess reaction processes and the coordination among the involved teams.


3) Strengthen defenses

Use the Sigma and Suricata detection rules of the application to improve your tool configurations.