◉ 24observe SOC Labs

Trainers · Running a cohort

Running a cohort

As an instructor you provision each student a private sandbox and a graded scenario in a few clicks. This page walks the whole setup, from your first login to a class that's ready to work.

i

Cohort provisioning is limited to platform administrators — the instructor account(s) on the allowlist. Students cannot create accounts or cohorts. If you can't see the provisioning controls, your account hasn't been granted instructor access yet.

The access model, in one paragraph

There is no public sign-up. Accounts exist only because an instructor created them — provisioning a cohort is the access grant. Each student gets their own isolated sandbox organization; they can see and work only their own lab, never another student's or yours. This keeps the class tidy and the data clean.

Step 1 — Sign in as the instructor

  1. Open learn.24observe.com and sign in with your instructor account.
  2. In the left sidebar, open Training → Labs. Because you're a platform admin, you'll see the instructor view.

Step 2 — Seed the scenario catalog (first time only)

If the Scenarios panel is empty, click Seed scenario catalog. This publishes the available lab scenarios (their titles, difficulty, and learning objectives). You only do this once per environment.

Step 3 — Provision a cohort

  1. In the Provision a cohort panel, give the cohort a name — e.g. soc-101-fall26. Use it consistently so you can filter the class later.
  2. Pick the scenario every student in this cohort will work (e.g. the SSH brute-force lab).
  3. Paste your student emails, one per line (commas are fine too).
  4. Click Provision cohort.

For each student the platform creates an account, a private sandbox, and the assigned lab — and returns a one-time temporary password.

!

Copy the temporary passwords now — they're shown only once. When provisioning finishes, a table lists each student with their temp password. Save it before you leave the page; for security it is never displayed again. If you lose one, you can re-provision that student (existing accounts are reused) or have them use the password-reset flow.

Step 4 — Distribute logins

Send each student their email + temporary password over a channel you trust (your LMS, a direct message — not a shared public doc). Tell them to go to learn.24observe.com and sign in. Point them at the student guide:

Getting started →

First login and the dashboard tour — share this link with the class.

The walkthrough →

A complete play-by-play of the brute-force lab, for students who want a guide.

Step 5 — Launch the session

Students click Start lab on their own card when they're ready. You don't need to start anything for them. As they work, the Cohort progress table updates live — see Reading results for how to interpret it.

✓

Re-running provisioning for a student who already has an account simply reuses it and assigns the new lab — no duplicate accounts, no second password. Handy for adding a latecomer to an existing cohort.

That's a cohort, live and ready. Next: Reading results to turn the progress table into teaching moments, or the facilitation guide for a ready-made lesson plan around the brute-force lab.