Platform Update

Dynamic Threat Ranges: Automated Scheduling and Execution Visibility

We are please to announce scheduling and real-time execution tracking are now live in our Immersive One Platform.

This update significantly streamlines the administrative overhead and live management of cyber exercises. By introducing scheduling and real-time execution tracking, we are enabling facilitators to focus entirely on participant engagement and learning outcomes rather than infrastructure management. These enhancements ensure that complex environments are ready exactly when needed and provide unprecedented transparency into the progression of simulated attacks.

Key Highlights

Scheduled Automated Deployment: Facilitators can now program a specific date and time for Dynamic Threat Ranges to initialize. This removes the need for manual activation and eliminates the "wait time" for environment provisioning during a live session, ensuring a seamless start for all participants.

Real-Time Attack Visualizer: A new intuitive dashboard provides a clear, high-level view of the attack lifecycle. This visual representation allows facilitators to track the progress of the simulation at a glance, pinpointing exactly where the exercise stands in its narrative.

Status Tracking: The visualizer categorizes every phase of the threat scenario into three distinct states:

• Completed: Clearly identifies successful previous actions.

• Executing: Highlights the current live threat activity.

• Pending: Outlines upcoming steps to help facilitators prepare for the next phase of the exercise.

New Content

CrowdStrike Falcon Lab Series

We are addressing the critical challenge of limited hands-on experience with endpoint detection and response (EDR) workflows. This release provides cybersecurity analysts and engineers with a dedicated environment to practice platform configuration, threat investigation, and SIEM-based hunting specifically using CrowdStrike Falcon.

Theoretical knowledge often fails to translate into effective incident response when under pressure. To bridge this gap, we have built a comprehensive, six-part interactive lab series that guides users from foundational concepts through to advanced threat response.

By practicing directly within a simulated CrowdStrike Falcon console, participants transform passive learning into active skill application. This series fosters the technical fluency required to navigate the platform, manage hosts, configure prevention policies, and conduct deep-dive investigations using process trees and Next-Gen SIEM querying. The experience culminates in a realistic APT (Advanced Persistent Threat) simulation, ensuring teams are ready for complex, real-world intrusions.

Who is this content for?

This content update is exclusively available to customers who have confirmed they currently purchase and utilize CrowdStrike products. It is specifically designed for:

• Cybersecurity Analysts & SOC Engineers: To build operational confidence in daily detection and triage tasks.

• Incident Responders: To refine containment and remediation strategies using native Falcon integrations.

• Security Architects: To practice and validate endpoint security configurations and policy management.

Key Lab Milestones
The series is structured to build technical competency progressively:

• Lab 1: Introduction: Understanding platform architecture and core EDR concepts.

• Lab 2: Host Management: Configuring users, roles, and retention policies.

• Lab 3: Endpoint Security: Creating prevention policies and managing Indicators of Compromise (IoCs).

• Lab 4: Detection Triage: Investigating malicious activity through process tree analysis.

• Lab 5: Next-Gen SIEM: Hunting for threats using advanced log queries (CQL).

• Lab 6: Targeted Scenario: An end-to-end response to a simulated APT intrusion.