Scenario, telemetry and feedback instead of “hack the box”
Start with skills, not the attack story
The goal of a lab is not the number of tools included in an image. Define what learners should be able to do: identify an entry point, confirm lateral movement, connect IOCs to TTPs, separate noise from validated activity and explain an investigation timeline.
Make activity observable
Each stage needs appropriate data: OS logs, Sysmon or other endpoint telemetry, network observations, SIEM correlation and filesystem artefacts. Avoid both overwhelming a learner and leaving them with no visible trace. A sound scenario can be reconstructed from evidence.
Separate actions from proof
The right answer is not merely naming the adversary tool. Ask learners to document timeline, evidence source, confidence and competing explanations. This resembles SOC and DFIR work more than a guessing game.
Repeatability and safety
Keep the range isolated from production, use test identities and controlled resources. Validate resets, expected duration, rules and unintended shortcuts. After the exercise, debrief on blind spots and detection improvements.
Takeaway
A strong cyber range connects action, observation and decision. Learners leave with an investigation method, not just an enjoyable challenge.