Sanraksha.SANJAY · SOC · SIEM · SOAR TRAINING SIMULATOR
Sanraksha.SANJAY is a complete SOC in a box: a live SIEM alert queue, SOAR playbooks and an attackable enterprise estate for training analysts on real attacks, fully offline.
01 · DETECT
Live telemetry from firewall, DNS, proxy, EDR, identity and OT sources is correlated into alerts with severity, SLA timers and a kill chain that maps every stage to MITRE ATT&CK.
Filter by severity and status, watch SLA countdowns turn red, and open any alert to see hosts, IPs, the rule that fired and the full kill chain of the campaign it belongs to.
Attack-chain coverage shows how deep the intrusion has progressed. Alert trend, severity mix, top attacking IPs and targeted hosts update live against a 20-events-per-second stream.
A deterministic, fully offline virtual L1 scores every alert on reputation, asset criticality and confidence, explains its decision, and can acknowledge noise autonomously.
02 · RESPOND
Incidents move through Detect, Investigate, Contain, Eradicate, Recover and Close. Automated steps run themselves; analyst steps wait for a human decision, and every decision is recorded.
The playbook pauses before a proportionate but disruptive action and asks the analyst to execute or skip, with notes.
Completed steps show their evidence: WLAN triangulation results, containment executed, credentials rotated, sweep dispatched.
A whole enterprise by tier, from perimeter to OT/ICS. Inspect any host’s agent status, firewall policy and detections, and isolate or restore it with one click.
03 · HUNT & ENGINEER
Author correlation rules, back-test them against 50,000 events, fire single ATT&CK techniques on demand to validate coverage, and hunt for the adversaries no rule has flagged.
Threshold, window, group-by, MITRE mapping and event filters, with an instant back-test showing which sources would have fired. Import Sigma rules or start from templates.
Fire Kerberoasting, DCSync, MFA fatigue, LOLBins or shadow-copy deletion on demand and confirm the expected rule caught it.
Hypothesis-driven hunts across live telemetry, scored on recall and false positives against the real ground truth.
04 · TRAIN & RUN COHORTS
Self-paced learners follow paths and labs that complete from real console actions. Instructors build timed exercises, assign teams and drive 25+ attack scenarios against a private estate per exercise.
L1 Analyst Foundations, L2 Incident Responder, SOC Leadership, Threat Hunter and Detection Engineer. Steps tick off automatically.
Beginner to Expert missions such as Triage a Brute Force or Contain the Ransomware, with objectives that update live as you work.
Build an exercise: attack timeline, custom estate size and auto-assigned SOC teams with L1, L2, L3 and CISO roles, then activate, pause, trigger and close.
Phishing to APT, insider threat, DDoS, DNS tunnelling, cloud identity, OT/ICS and CI/CD compromise, each tagged with the rules it exercises.
Arrange a demonstration, an extended training window, or a private instance for your team.