START HERE: 1) Add or keep the sample network → 2) press Start Simulation → 3) watch the packet → 4) click the affected endpoint → 5) read the process change. You do not need to understand every panel before starting. Want endpoint-only learning? Open Endpoint Lab →
RR CYBERLAB • NETWORK + ENDPOINT SIMULATOR
Build it. Watch the packets.
Break it. See the endpoint react.
CyberBuilder is a browser-based learning simulator inspired by network labs: build a small environment, connect devices, start packet flow, launch a safe attack scenario and watch how network traffic becomes endpoint and security telemetry.
① BUILDAdd devices, zones and links.
② PACKET FLOWSee source → router → firewall → destination.
③ ATTACKGenerate simulated malicious traffic.
④ IMPACTWatch endpoint, identity and controls change.
● SIMULATION: IDLE
INTERNET / WAN
INTERNAL LAN • 10.0.1.0/24
DMZ • 10.0.3.0/24
LIVE PACKET FLOWNETWORK FUNDAMENTALS
| TIME | SOURCE | DESTINATION | PROTO | PORT | STATE |
|---|
ENDPOINT IMPACTEDR VIEW
Learning loop: first understand normal traffic — Endpoint → Switch → Router → Firewall → Server. Then introduce abnormal behavior and compare the packet path with endpoint/process/authentication evidence. The goal is to connect networking fundamentals to SOC investigation, not to perform real exploitation.
Connect this lab to GRC
Use the fictional alerts, endpoint events and network evidence from this lab to practice describing a risk, choosing a safeguard, assigning an owner and recording evidence. SIEM, NDR and EDR signals help explain what happened; GRC makes the response measurable and accountable.