SOC Shift Desk
Work one analyst shift: triage, hunt, tune, hand over, then check the key.
Loading the event lake and the rule engine.
Kestrel Ledger SOC is a fictional sample estate. The shift is saved in this browser only.
How it comparesHow it compares
Checked 2026-11-06 against each project's own source and docs. The desk is a training range with real export formats, sized for one shift. A case platform runs a team for years.
| Capability | This desk | TheHive 5 / DFIR-IRIS | Training ranges (BOTS, attack_range, queue labs) |
|---|---|---|---|
| Alert to case, merge alerts into one incident | Yes, verdict links alerts to an incident | Yes, with alert similarity and merge | Queue labs: yes. BOTS: questions, no cases |
| Observables with IOC flag, TLP and PAP | Yes, per observable, TLP 2.0 incl. AMBER+STRICT | Yes | No |
| Tasks and response log | Response actions with owners, pending items carry over | Tasks, task logs, templates, responders | Partial |
| MTTD, MTTA, MTTR | From the shift clock, per alert and incident | TheHive KPIs from alert and case dates | Not measured |
| Exports | TheHive case and alert JSON, DFIR-IRIS alert JSON, STIX 2.1, ATT&CK Navigator layer, Alert Budget NDJSON | Native API, MISP, STIX via plugins | None |
| Answer key and grading | Yes, plus seeded variants with new addresses and IDs | No | Yes, fixed datasets |
| Scale, users, case templates, automation | One analyst, one shift, in the browser | Multi-tenant, RBAC, Cortex analyzers, playbooks (Shuffle) | Full SIEM stack to deploy |
- TheHive JSON follows the InputAlert, InputCase, InputObservable, InputTask and InputProcedure types in thehive4py 2.1.0, checked key by key with strict type validation.
- DFIR-IRIS JSON follows the alert columns and IocSchema / CaseAssetsSchema in iris-backend v3.0.0-beta.20. Severity, status, TLP and IOC type ids are a fresh install's defaults (identical in v2.4.29); check yours under Manage.
- STIX bundles pass the OASIS stix2-validator 3.3.1 in strict mode with the official 2.1 JSON schemas. Navigator layers load in mitreattack-python 6.4.0 (layer format 4.5).
- Known limits: one fictional estate with seeded variants of it, no case templates or custom fields, no multi-analyst assignment. ATT&CK names come from the v19.2 snapshot; v20 is current.
SOC Shift Desk FAQ
What happens in a shift?
You take the APAC shift from 00:00 to 09:00 UTC for Kestrel Ledger, a fictional company. Acknowledge the AMER handover, move the shift clock, and alerts arrive when their condition was met. Record a verdict with a reason for each alert, link true positives to incidents, take response actions, run hunts, file tuning requests and send a handover note to EMEA.
How are the alerts raised?
Seven Sigma rules run on sigma.js, the engine behind the pwnsy Detection Workbench, over EDR, SSE, WAF, IdP and CloudTrail style records. Two multi-step detections are correlations in JavaScript: a credential stuffing burst followed by a successful login from the same network, and one sign-in session used from two networks.
How does the tuning check work?
A tuning proposal adds a filter built from the fields that separate the alerts you closed as false or benign from the ones you confirmed. The rule is then re-run over every event, and the proposal is blocked if it would drop a confirmed true positive.
Which lookups are live?
IP addresses go to RDAP for the network owner and to the pwnsy exit-IP API for the Tor Project exit list. Domains go to Cloudflare DNS over HTTPS and RDAP, npm packages to OSV, and CVEs to the CISA KEV catalogue from CISA's kev-data repository. The npm package ethersscan-api and the two VPS addresses are real, so those lookups return true answers. Every other event is invented.
Can I score my shift?
Yes. The answer key lists the verdict a good shift reaches for every alert and what each hunt should find, and compares it with yours. Send verdicts to Alert Budget turns your closed alerts into per-rule precision and triage load on the Alert Budget page.
Which formats can I export?
Each incident exports as a TheHive 5 case with observables, tasks, alerts and ATT&CK procedures, as DFIR-IRIS alerts with IOCs and assets, and as a STIX 2.1 bundle of indicators and sightings. The handover exports the shift as an ATT&CK Navigator layer, a STIX bundle and Alert Budget NDJSON. Every observable carries an IOC flag, TLP and PAP.
Is anything uploaded?
No. Detections, hunts, tuning and the handover run in your browser, and the shift is saved in this browser only. The live lookups send only the indicator you look up.
Every person, host, customer and event belongs to Kestrel Ledger, a fictional company. The npm package ethersscan-api (OSV MAL-2024-8847) and the owners of the two VPS addresses are real so the live lookups return true answers; the activity around them is invented. Documentation ranges stand in for attacker infrastructure. ATT&CK names come from the pinned MITRE ATT&CK v19.2 snapshot used across the detection suite.