🎬 Guided scenario
The 39 practicals are real, but they're isolated. This page chains four of them into one incident — attack → detect → respond — so you can see the whole story a security team lives, not just one lab at a time.
Honest by design: every link below opens a real lab page you actually
operate — nothing here is faked, pre-filled, or simulated on your behalf. A step marks
itself done only when your own audit trail shows the real event actually happened, read live
from GET /api/xray/events — the same event log behind the
X-ray panel everywhere else in the Lab. This page adds no new server endpoints.