All features

Mobula · Analyst Academy

The only SOAR
that trains
your SOC.

Mobula doesn't just run your SOC - it grows it. Built-in skill-tree lessons, an AI tutor, hands-on practicals, quizzes, XP and certifications. Onboard a junior analyst inside the tool they'll actually use.

6
Learning tracks
40+
Practical exercises
4
Certifications
Academy / r.haddad - Level 4 Analyst
4
r.haddad2,840 XP
1,160 XP to Level 5
Threat Detection IIncident ResponseIn progress: Threat Hunting
Current module
Threat Hunting - Module 3
Lateral movement detection using process trees
2/5 lessons
01

A structured path from junior to expert.

Six learning tracks, each broken into modules - from fundamentals to advanced threat hunting. Analysts progress at their own pace, earning XP as they go. Every track is built around what they'll actually encounter in the platform.

Threat Detection
✓
Alert triage basics
Reading alerts, severity, false-positive patterns
Complete
✓
MITRE ATT&CK fundamentals
Tactics, techniques, and how Mobula maps them
Complete
3
Correlation & clustering
How Mobula groups related alerts into stories
In progress
4
Advanced detection tuning
Adjusting thresholds, custom rules, noise reduction
Locked
Incident Response
✓
Incident lifecycle
Open, investigate, contain, close - in Mobula
Complete
✓
Playbook execution
Running automated and manual playbook steps
Complete
✓
Blast radius assessment
Mapping affected entities, scoping the damage
Complete
4
Post-incident reporting
Writing the case summary, timeline, and remediation
In progress
02

Stuck? Ask Mobi. It knows the curriculum.

The AI tutor is built into every lesson. Ask it to explain a concept, walk you through a technique, or show you a real example from your own alert history. It teaches from the platform - not from a PDF.

Mobi Tutor / Threat Hunting - Module 3
What's the difference between lateral movement and privilege escalation? I keep getting them mixed up.
r.haddad
Good question - they're often chained together so it's easy to confuse them.

Lateral movement is about moving between systems - attacker has a foothold on Host A and needs to reach Host B (maybe because the data they want is there).

Privilege escalation is about gaining higher permissions on a system they're already on - going from a standard user to local admin or SYSTEM.

In your recent alert ALT-2026-3847, you'll see both: svc-backup escalated to admin on WS-04 (privilege escalation), then moved to FIN-DB-03 (lateral movement). Want me to open that case so you can trace the chain?
Mobi - AI Tutor
Yes please, that would help a lot.
r.haddad
+50 XPPractical learning bonus - Mobi linked a real alert to your lesson
03

Learn by doing - on real alerts.

Every module ends with a hands-on practical. Mobula surfaces a real (or anonymized) alert from your environment and walks the analyst through the investigation step-by-step. Not a sandbox. The actual platform.

Practical / Module 3 - Lateral movement detection
Investigate: Service account lateral movement
Alert ALT-2026-3847 · 22 correlated events · Guided walkthrough
In progress
01Open the alert and identify the source entity. What type of account triggered the first alert?✓
02Check the process tree on WS-04. Find the parent process that spawned the unusual child.✓
03Map the lateral movement path. Which hosts did the attacker touch between WS-04 and FIN-DB-03?
04Identify the technique. Open the MITRE panel and find the ATT&CK technique that matches this movement pattern.
05Recommend containment. Write the first playbook step you would run to stop further spread.
2 / 5 steps complete+150 XP on completion
04

XP, certifications, and a team leaderboard.

Analysts earn XP for every lesson completed, practical solved, and real alert handled. Certifications unlock at track completion. The leaderboard makes growth visible - to analysts, leads, and customers.

Team Leaderboard / This month
#1
s.okonkwo
Senior Analyst
3 certs6,420 XP
#2
m.chen
Analyst L3
2 certs5,110 XP
#3
r.haddad
Analyst L2
2 certs2,840 XP
#4
p.alvarez
Junior Analyst
1 cert1,200 XP
#5
j.lin
Junior Analyst
880 XP
🏅
Threat Detection I
🏅
Incident Response
🔒
Threat Hunting
🔒
Forensics & DFIR

Skill trees · AI tutor · hands-on practicals · certifications

Your SOC runs better
when it learns together.

Onboard junior analysts faster, level up your whole team, and build the kind of institutional knowledge that doesn't walk out the door when one person leaves.

Book a POCSee all features
Mobula SOAR · built-in academy · no external LMS required