🔴 Red Team
Authorized security testers simulate attacker behaviour to reveal weaknesses in systems, people, and processes before criminals exploit them.
Impact on IT: exposes gaps in access, patching, and configuration.ENTER THE CYBER RANGE
Movie-inspired visuals. Real cybersecurity concepts. Simulated attacker actions, observable endpoint behaviour, and defender decisions — all inside a fictional, safe environment.
🔰 Learn foundations🔴 Red Team🖥 Endpoint telemetry🔵 Blue Team🟣 Purple TeamSTART HERE • NO CYBERSECURITY EXPERIENCE REQUIRED
Learn it in 3 simple steps
Don’t know what a process, port or alert is? That’s okay. Start with the basics, watch a safe attack simulation, then make a defender decision.
01Learn the idea
02Watch the simulation
03Investigate & decide
IN PLAIN ENGLISH
Red Team tries a controlled attack. Endpoint shows what changed. Blue Team looks for evidence and responds. Purple Team uses the lesson to improve detection.
🔵 Blue Team
Defenders monitor logs, investigate alerts, contain threats, and improve protection of endpoints, identities, and networks.
Impact on IT: improves visibility, response, and resilience.🟣 Purple Team
Red and Blue teams collaborate: run an authorized simulation, verify detection, identify missed signals, and strengthen defenses.
Impact on IT: turns findings into practical improvements.How the teams connect
🔴
Simulate
→Simulate
🖥
Endpoint + Network
→Endpoint + Network
🔵
Detect + Respond
→Detect + Respond
🟣
Improve
Improve
IT operates the infrastructure; cybersecurity helps protect it. Example: IT enables remote administration; security verifies MFA, access rules, monitoring, and incident response.
What is a computer?
A computer processes information using hardware and software. It runs an operating system, applications, and background processes.
Example: a laptop runs a browser, which can request a website.
Which component runs applications?
Choose an answer to check your understanding.
0 topics completed
CHOOSE YOUR LEVEL
Mission 01 · Suspicious login
A fictional workstation receives a series of login attempts. Observe the events, then decide what the defender should do.
Beginner hintCompare who is targeted and whether any login succeeds. A few failures alone do not prove compromise.
MITRE ATT&CK learning mapT1110 — Brute Force (candidate mapping; validate against evidence).
All traffic, accounts and events are fictional. No external systems are contacted.
LIVE SIMULATED TELEMETRY
[SYSTEM] Training environment ready.\n[HOST] WS-014 online.\n[EDR] Waiting for simulation.
Start the mission to reveal evidence.
ANALYST PERFORMANCE
Your learning report
Finish a mission to see what you understood and what to practise next.
Mission score: 0 / 100
What comes next?
Use CyberBuilder to design a network, Endpoint Lab to examine host events, and AttackMap to practice full investigation workflows.
CyberBuilder → Endpoint Lab → AttackMap →
For business security assessments and endpoint, network, or SOC consulting, explore RR CyberLabs services.
WANT TO GO FURTHER?
Talk to RR CyberLabs →Need help with your cybersecurity journey?
Use the lab to learn the concepts first. If you need training, security assessment, endpoint, network or SOC guidance for your organization, contact RR CyberLabs.
Connect this lab to GRC
Use the fictional alerts, endpoint events and network evidence from this lab to practice describing a risk, choosing a safeguard, assigning an owner and recording evidence. SIEM, NDR and EDR signals help explain what happened; GRC makes the response measurable and accountable.