Coming after launch
SOC Fluent launches with KQL, Elastic and Sophos SQL. Here’s what we’re adding next, so there’s more to practise once you know the basics.
More query languages
Every exercise will work in these too, so you can switch language on the same exercise.
Splunk SPL
Splunk Enterprise and Splunk Cloud
CrowdStrike Falcon (CQL and FQL)
CQL for event search and Next-Gen SIEM, FQL for filtering in the console and API
Trend Vision One
Vision One search
Rapid7 InsightIDR (LEQL)
InsightIDR log search
The languages ready at launch are KQL, Elastic KQL and ES|QL, and Sophos SQL.
More reasons to keep practising
A new incident every week
A fresh investigation each week. Solve it in your language, see how you did, then read how it was solved.
A profile that shows your skills
Earn a score in each language and share it on your CV or LinkedIn.
Seasonal challenges
Short, ranked events every few months, open to everyone.
Five-minute refreshers
Quick drills to keep the languages you don’t use every day fresh.
Get seen by teams who are hiring
Companies looking for analysts will be able to find you, but only if you choose to share your profile.
Be first in when it launches
Join the waitlist and we’ll email you once, on launch day. Tell us which SIEM or EDR you use and it helps us decide what comes first.