User Guide
Complete walkthrough for Administrators, Instructors, and Students
Contents
Getting Started
Accessing the platform and logging in for the first time
First launch The database is created and seeded automatically on first startup. Default roles (Administrator, Instructor, Student) and an admin account are created with no manual setup required.
Default Admin Credentials
admin@cyberlab.com | |
| Password | Admin@123! |
| Role | Administrator |
Change the default password after your first login via User Management → Edit your profile.
Navigation Overview
The sidebar groups features by area. Visible items depend on your role.
Dashboard
Platform overview — active students, simulations, total scenarios, average score, recent alerts.
Cyber Range
Simulations list and session viewer for students. Instructors can browse all sessions.
Assessment
Scores, rankings, reports, and certificates — grouped in the lower sidebar section.
Administration
Users, roles, and scenarios — visible to Administrators and Instructors only.
Administrator Guide
Full platform control — users, scenarios, reports, and certificates
As Administrator you have unrestricted access to every section. Use this account to onboard instructors and students before handing off day-to-day teaching to Instructors.
Managing Users
Navigate to Users in the sidebar. This page lists every account with search and pagination.
Click Add User. Fill in First Name, Last Name, Email, Password, and select a Role (Administrator / Instructor / Student). Click Save.
Click the pencil icon on any row. You can update name, email, role, and active status. You cannot change another user's password from this screen — the user must do that themselves.
Toggle Active to lock a user out without deleting their data. Use Delete to permanently remove them. Deleted users' session history is also removed.
Navigate to Roles in the sidebar to see all three system roles (Administrator, Instructor, Student) with their member counts.
Managing Scenarios
Navigate to Scenarios. Scenarios define the type of cyberattack students will practise defending against.
Click New Scenario. Fill in: Name, Description, Category (SQL Injection / XSS / Password Attack / Network Monitoring / Social Engineering / Malware Analysis), Difficulty (Beginner / Intermediate / Advanced / Expert), Duration (minutes), Points, and Learning Objectives. Click Create.
Newly created scenarios are in Draft status. Students cannot see drafts. Click Publish to make it available. Use Archive to retire it without deleting historical data.
Only scenarios in Draft or Archived status can be deleted. Published scenarios with active sessions cannot be deleted — archive them first.
Six scenario categories are supported. Each category has a dedicated question bank and a set of defence actions built in — no configuration required.
Reports & Export
Navigate to Reports. Two report types are available, each exportable as Excel (.xlsx) or PDF.
Student Report
Session-by-session breakdown for one student — exercise score, defence score, penalties, grade, completion rate, and success rate.
Scenario Report
Per-scenario metrics — pass rate, most missed questions (with miss-rate percentage), difficulty rating, and all student attempt results.
On the Reports page, select a student or scenario from the dropdown, then click View. The report opens as a full page with colour-coded grade badges.
Click the green Excel button. The file downloads immediately with formatted headers, colour-coded grade cells, and section separators.
Click the red PDF button. The file downloads as a formatted A4 document with CyberLab branding, tables, and page numbers.
Certificates
Navigate to Certificates. As Administrator you are redirected to the Manage view showing all issued certificates across the platform.
Use the search box to filter by student name. The table shows certificate number, student, scenario, final score, session count, and issue date.
Click the download icon on any row to get the PDF certificate for that student. You can share or print it.
If a student has met the eligibility requirements but has not claimed their certificate, you can issue it for them from the Manage view.
Certificate eligibility: The student must have at least one scored session for the scenario and an average score of 60% or above on that scenario. One certificate is issued per scenario — students who already passed cannot retake.
Instructor Guide
Create scenarios, monitor live sessions, and review student performance
Instructors can do everything a student can, plus create and publish scenarios, view all reports, and monitor the live dashboard. Instructors cannot manage other users' accounts — that is an Administrator-only action.
Creating & Publishing Scenarios
Click Scenarios in the sidebar. You will see all scenarios you have created, plus any published scenarios created by others.
Click New Scenario. Choose the category carefully — it determines which attack events are generated in the simulation, which exercise questions are asked, and which defence options are presented.
Difficulty affects how the scenario is labelled (Beginner → Expert). Points set the maximum score students can achieve. The scoring engine normalises this against the exercise and defence question marks automatically.
Once you are satisfied, click Publish on the scenario card or detail page. Students will immediately see it in their Simulations list. Draft scenarios are invisible to students.
Click Archive to retire the scenario. Archived scenarios no longer appear to students but all historical data (sessions, scores) is preserved for reporting.
Live Monitoring Dashboard
Navigate to Monitoring in the sidebar (visible to Instructors and Administrators only).
The dashboard shows a live stream of attack events as they are generated across all active simulation sessions. Events are colour-coded by severity (Critical → Low).
The right-side panel lists every currently active session with the student's name, scenario, and session start time. This updates automatically via SignalR — no refresh needed.
Summary widgets at the top of the page show counts for Critical, High, Medium, and Low alerts generated in the last hour. Use these to gauge student activity levels.
The LIVE badge in the sidebar nav link pulses green when there are active student sessions. It fades when all sessions are idle.
Reviewing Student Performance
Navigate to Scores. View all scored sessions with grade badges (Distinction / Merit / Pass / Not Yet Competent). Click any row for a full score breakdown including exercise, defence, and penalties.
Navigate to Rankings for a leaderboard of all students sorted by average score. Useful for identifying top performers and students who need support.
Use the full Reports section to generate and export Student Reports and Scenario Reports in Excel or PDF format.
Student Guide
Run simulations, complete exercises, apply defences, earn certificates
Students are created by an Administrator. Your instructor will share your login credentials. All activities are simulated — you are not performing real attacks or accessing real systems.
Running a Simulation
Navigate to Simulations in the sidebar.
The Simulations page lists all published scenarios. Each card shows the category, difficulty badge, point value, and duration.
Click Start Simulation on any scenario card. A confirmation screen shows the scenario details. Click Launch Simulation to begin — this creates a new session and generates your unique attack event sequence.
The Session screen shows a terminal-style live feed of attack events (e.g. "Brute Force Attempt detected from 192.168.x.x"). Events appear one by one with timestamps. Read them carefully — the exercise questions will refer to them.
Once the feed completes (or at any point), click Begin Exercise at the bottom of the session screen to answer the security questions.
Retake policy: If you score below 60% on a scenario, a Retake Scenario button appears on your results page — click it to start a fresh session. If you have already passed (≥ 60%), retakes are not available. You can attempt as many different scenarios as you like.
Completing the Exercise
Each simulation has exactly four exercise questions. Answer all four before submitting.
Q1 – Identify Attack Type
Multiple choice. Select the category of attack shown in the event feed (e.g. SQL Injection, XSS, Brute Force).
Q2 – Select Mitigation
Multiple choice. Choose the most appropriate mitigation strategy for the identified attack.
Q3 – Explain Impact
Short written answer. Describe the potential damage the attack could cause. Scored by keyword matching (3+ keywords = full marks).
Q4 – Apply Defence Action
Multiple choice. Select the virtual defence action that best responds to the active attack.
Click an option card to select your answer for multiple-choice questions. Type your response in the text box for Q3. All four must be answered before you can submit.
Click Submit Exercise. Your answers are evaluated immediately — no waiting required.
The Results page shows your score per question, whether each answer was correct, and written feedback. A score banner at the top shows your total exercise score and grade band.
Click Proceed to Defence to continue to the defence actions stage for this session. You can also return later via the Simulations list.
Defence Actions
Navigate to Defence from a session, or via the Simulations list → Defence button.
The defence screen lists the attack events from your session. For each event you must choose the appropriate response action (e.g. Block IP, Reset Password, Apply Patch, Enable Firewall Rule, Review Logs, Quarantine Device).
Click the response button that best addresses each attack. Some events accept multiple valid responses — the system awards full or partial credit accordingly.
Click Submit Defences when you have responded to all events. The system evaluates each response and shows a results page with per-event feedback and your defence score.
After submitting defences, the scoring engine combines your exercise score and defence score (minus any late penalties) into a final grade. Navigate to Scores to see it.
Scores & Rankings
Navigate to Scores. Your personal score history lists every session you have completed with exercise marks, defence marks, penalties, final score, and grade badge.
Click any score row to open the detailed breakdown showing individual question results, defence responses, and how the final score was calculated.
Navigate to Rankings to see where you stand among all students on the platform, sorted by average score. Your own row is highlighted.
Navigate to Reports. As a student you can generate and download your own Student Report (Excel or PDF) showing your full performance history.
Claiming Your Certificate
Click Certificates in the sidebar. If you meet the eligibility conditions for any scenario, a green Ready to Claim panel appears showing the scenario name, your average score, and a Claim Certificate button.
Click Claim Certificate. A unique certificate number is generated (e.g. CERT-2026-K3P9QR) and the certificate is issued instantly. Eligibility requires: at least one scored session for that scenario with an average score ≥ 60%.
Issued certificates appear as cards showing the scenario name, score, session count, issue date, and certificate number. Click Download PDF to get a professional A4 landscape certificate with your name and details.
Certificates include your full name, scenario name, final score, completion date, and a unique certificate number. You can earn one certificate per scenario and download it as many times as you like.
Scoring Reference
How marks are calculated and what each grade means
Mark Allocation per Question
| Question | Type | Correct | Partial | Wrong |
|---|---|---|---|---|
| Q1 – Identify Attack Type | Multiple choice | +10 | — | 0 |
| Q2 – Select Mitigation | Multiple choice | +10 | — | 0 |
| Q3 – Explain Impact | Free text (keywords) | +10 (≥ 3 keywords) | +5 (1–2 keywords) | 0 |
| Q4 – Apply Defence Action | Multiple choice | +10 | — | 0 |
| Each Defence Response | Action selection | +10 | +5 (partial match) | 0 |
| Late submission penalty | Per component | — | — | −2 per late item |
Grade Bands
| Grade | Score Range | Description |
|---|---|---|
| Distinction | 90% – 100% | Excellent understanding of attack types, mitigations, and defence responses. |
| Merit | 75% – 89% | Good performance with minor gaps in knowledge or response accuracy. |
| Pass | 60% – 74% | Basic competency demonstrated. Review missed areas before the next scenario. |
| Not Yet Competent | 0% – 59% | Insufficient understanding. Use the Retake Scenario button to try again. |
Certificate eligibility threshold: An average score of 60% or above on a scenario qualifies a student for that scenario's certificate. Students who score below 60% can retake the scenario as many times as needed.
Scenario Categories & Attack Types
| Category | Typical Attack Events Generated |
|---|---|
| SQL Injection | Malicious query input, database error probing, privilege escalation via SQL |
| XSS (Cross-Site Scripting) | Script injection in forms, cookie theft attempt, DOM manipulation payload |
| Password Attack | Brute force login attempts, credential stuffing, dictionary attack, account lockout trigger |
| Network Monitoring | Port scan detected, suspicious IP access, unusual traffic volume, data exfiltration alert |
| Social Engineering | Phishing link click, impersonation attempt, pretexting alert, vishing indicator |
| Malware Analysis | Malware detection alert, ransomware indicator, C2 beacon detected, suspicious process spawn |