What you get
- Your own Splunk login for seven days. Credentials are emailed when you enroll. You write and run the searches yourself.
- A seven-stage intrusion, in order. Reconnaissance, web enumeration, initial access, command and control, discovery, exfiltration and a simulated ransomware stage — one scenario, worked stage by stage.
- Packet captures. Downloadable PCAPs you open in Wireshark, including the ones that hold evidence the logs can’t show.
- Incident handling. INC-002 walks through the PICERL framework using the investigation you just worked.
- Modules for your organization. Operation Alpha, a sponsor module built for CyberjutsuCon 2026 attendees, shows how a company, school or event can add its own investigation to First Watch for its people. Contact Cover6 to add one.
- You run the scan yourself. The Red Team Drill has you scan a designated Cover6 lab target, then find your own traffic in Splunk.
- A graded capstone and a verifiable certificate. Pass the capstone and the final knowledge check to earn the First Watch certificate (SOC Analyst, Level I) with 5.5 CPE hours, which anyone can check at cover6solutions.com/verify.
- A clear next step into SOC Analyst Prep Labs.
First Watch is aligned with DoD 8140 work role 511, Cyber Defense Analyst.
Evidence first
Most training hands you an alert and asks what you’d do. First Watch hands you a week of evidence and asks what it proves. Odapeeka State University is a fictional training scenario built from designed log data and packet captures. Each lesson asks the analyst’s questions: what does this source show, what does it only suggest, and what would you need to confirm it?
What makes it different
- You query it yourself. Every lesson gives you the search, tells you exactly what it should return, and explains what that result does and doesn’t prove.
- The whole chain, in sequence. One coherent scenario across seven stages, so you learn how an intrusion develops rather than how to spot seven unrelated alerts.
- What your detection can’t see is part of the lesson. A port scan never reaches the web server’s log, an encrypted SSH session hides its commands, and a transfer with no flow log shows up only in a packet capture. You learn where to pivot.
- Both sides of the wire. Scan the designated target, then catch yourself in the SIEM.
Who it’s for
- Career-changers who want hands-on SIEM practice to talk about in an interview.
- Students and self-taught learners who’ve read about SOC work but never touched a SIEM.
- Help-desk and IT staff moving into security.
- Red-teamers who want to see their own noise from the defender’s chair.
No experience required. If you can read a log line, you can start.
How the free week works
- Enroll and your lab credentials arrive by email.
- Lab access runs for seven days from enrollment. The lessons are open from the start, so you work at your own pace.
- Want more time? A 30-Day Lab Extension keeps your lab open.
Where it leads
First Watch is one scenario. SOC Analyst Prep Labs is the full course: a live lab target, threat-intel enrichment, endpoint forensics and a complete incident report. If you want the offensive side instead, Cover6: First Shell is the same idea pointed the other way.
FAQ
Is it free? Yes. Enroll, get your Splunk login, work the investigation and earn the certificate — no card required.
Do I need to install anything? No. Splunk runs in your browser. Wireshark (free) is needed for the packet-capture exercises.
How long do I have? Seven days of lab access from enrollment.
Is the incident real? No. Odapeeka State University is a fictional training scenario. The skills are the ones analysts use on real incidents.
Do I need experience? No. Day 1 starts with one question and one search.
