Start your way

What brings you to CDK?

Choose the route that best matches where you are today. You can switch paths at any time—the concepts, labs, and tool guides are designed to work together.

01 I'm new to cyber defence Understand the capabilities and follow the guided learning path. Learn the concepts 02 I want to build a lab Compare approachable labs by goal, complexity, and environment. Choose a first lab 03 I already know what I need Browse monitoring, network, endpoint, response, and forensic guides. Browse the toolkit

A practical learning path

From concepts to investigation

CDK connects deployment instructions, controlled simulations, telemetry, detections, and investigations—so you can see how defensive tools work together, not only how to install them.

Ⅱ Pause animation

01Learn 02Build 03Detect 04Investigate

Understand the defensive landscape

Learn what each SOC capability does, where it fits, and which open-source tools can provide it.

Explore core concepts

Recommended starting points

Choose your first lab

Not sure where to begin? Choose a lab by learning goal and setup complexity. Each route combines practical documentation with a proof-of-concept demonstration.

What do you want to practise?

Show all Analyse traffic Detect threats Investigate incidents

4 recommended labs

Quick startBeginner

Wireshark traffic analysis

Inspect packet captures, apply display filters, and investigate malware traffic.

First result: identify suspicious traffic in a supplied packet capture.

Single workstationSample PCAPsLow setup effort

Open guide ▶ Watch demo

Network detectionBeginner

Suricata IDS lab

Monitor network traffic, generate controlled activity, and analyse IDS alerts.

First result: generate and investigate a network detection alert.

Linux environmentOffline guidanceLow setup effort

Open guide ▶ Watch demo

SIEM and XDRIntermediate

Wazuh detection lab

Collect endpoint telemetry, investigate alerts, and test active response.

First result: collect endpoint activity and trace it through an alert.

Multi-host labOffline guidanceMedium setup effort

Open guide ▶ Watch demo

Case managementIntermediate

DFIR-IRIS investigation

Create a case, organise evidence, and document a structured incident investigation.

First result: build a structured case from evidence to findings.

Container deploymentIntegrated workflowMedium setup effort

Open guide ▶ Watch demo

Proof of concept

See the Cyber Defence Kit in action

The dedicated CDK YouTube channel brings the documentation to life through demonstrations conducted in safe, controlled lab environments.

SIEM and XDR

Build and test a Wazuh security lab

Simulate cyber attacks, investigate the resulting alerts, and test active response.

▶ Watch on YouTube Open guide

SIEM and XDR01 Build and test a Wazuh security lab Currently selected Network analysis02 Investigate malware traffic with Wireshark Select video DFIR03 Hunt and investigate with Velociraptor Select video Adversary emulation04 Validate defences with MITRE Caldera Select video

▶Visit the CDK YouTube channel Explore all documentation

Explore by outcome

Build your defensive toolkit

Already know what you need? Choose a capability to open its concepts, tools, and implementation guides.

Collect and correlate

Security monitoring

Centralise logs, detect suspicious activity, and investigate alerts.

Splunk · Wazuh · Security OnionExplore SIEM Observe and detect

Network defence

Inspect traffic and identify malicious patterns across the network.

Suricata · Snort · Zeek · Wireshark · ZuiExplore network defence Hunt and contain

Endpoint visibility

Investigate process activity and collect endpoint evidence.

Velociraptor · Aurora LiteExplore EDR Triage and coordinate

Incident response

Manage investigations and automate repeatable response workflows.

TheHive · DFIR-IRIS · ShuffleExplore response Acquire and reconstruct

Digital forensics

Preserve evidence, analyse artefacts, and reconstruct activity.

Velociraptor · KAPE · Plaso · VolatilityExplore DFIR Test and improve

Security validation

Emulate adversary behaviour and measure defensive controls.

MITRE Caldera · ATT&CK NavigatorExplore validation

Project coverage

Practical content that keeps growing

Deployment guidance, controlled demonstrations, and offline-aware workflows across the defensive toolkit.

DOC95Practical guidesConcepts and deployment

PoC12Guides with PoC videosWatch, build, and validate

OFF25Offline-aware guidesConnected and air-gapped

SOC5Security capability areasMonitoring, detection, response, forensics, and validation