Hands-on blue team training. Reopen real attacks as cold cases: open the case file, follow the evidence in real malware reports, solve it. Nothing to install.