DevSecOps Incident Response Game Day
By Richard Augenti
Run a live compromise of a pipeline and cluster end to end: detect it, contain it, evict the attacker, and produce the timeline and control changes that come out of it.
Free to browse. Takes about 90 minutes once you start.
Lab Overview
This is the capstone. A workload on the payments platform has been compromised and is running right now.
Your job is the incident responder's: scope what happened from the logs, identify how the attacker got in from the service's SBOM, contain the compromised workload, and write the postmortem that turns the incident into a preventive control. You will use the same tools you built earlier in the track - SBOMs, log detections and the dependency vulnerability - which is what makes this the last lab rather than the first.
Everything runs on your own lab machine. Loki holds the incident logs and the compromised container is running locally, so containment is real but confined to this VM.
What to Expect
- Environment: a single Ubuntu machine you connect to over SSH, with Loki holding the incident logs and the compromised container already running. No cluster required.
- Access: SSH credentials are generated for your session and shown in the workspace. They are destroyed when the lab ends.
- Length: this is the longest lab in the track and is scheduled for roughly 90 minutes. Start it when you have the time to finish it, because your work is not saved.
- Progress: your work is not saved. If the lab expires or you quit, the machine and everything on it is destroyed.
What are hands-on labs?
A lab is a real environment, not a simulation. You get a live machine with the tooling already installed, a task taken from production work, and root access to take it apart. Nothing is mocked, nothing is multiple choice. It either works or it doesn't.
Real tooling
The same commands you would run at work, on a machine that is already set up for them. No screenshots, no sandboxed toy version.
Break it freely
Everything is disposable. When the clock runs out the environment is destroyed with everything in it, so there is no reason to be careful.
Useful on Monday
Built by engineers who run these systems in production. Skills you can apply to your own stack the same week, not exam preparation.