Training on the tools you already run: Falcon, Splunk and Sentinel inside training platforms

A skill learned on one console does not always transfer to another. An analyst who can investigate an intrusion in a generic lab environment may still fumble the same task in the EDR or SIEM their employer actually uses. Training platforms have been closing that gap, and two Immersive Labs announcements in early 2026 show how far it has gone.

What did Immersive Labs announce?

On 27 January 2026 Immersive announced live, provisioned CrowdStrike Falcon environments on Immersive One, for training on Falcon Insight XDR and Falcon Next-Gen SIEM, with an APT41 intrusion scenario.

On 17 March 2026 it announced native exercising inside CrowdStrike Falcon, Google Security Operations, Splunk, IBM QRadar and Microsoft Sentinel. The same release added heat maps against NIST CSF, NIST NICE, MITRE ATT&CK, D3FEND and ATLAS, GRC content for ISO 27001, ISO 42001 and SOX, and enhanced after-action reporting for its crisis simulations.

Separately, Immersive describes its Dynamic Threat Range as a live-fire attack on the customer's own stack, naming tools such as Microsoft Sentinel, Elastic, Splunk and CrowdStrike.

How do other platforms approach tools?

Cyberbit's RangeForce content, now in Cyberbit Readiness, uses tools from CrowdStrike, Splunk, Palo Alto Networks, Fortinet and Microsoft. That is training on commercial tools in a range environment, rather than inside the customer's own instance; the pages we read do not describe building exercises from the customer's environment. Cloud Range describes a customised replica of the customer's network with licensed versions of real SOC tools, across IT, OT/ICS, cloud and hybrid environments, with MITRE ATT&CK-aligned scenarios. SimSpace invites teams to bring their team, their tools or their AI agents into an environment it builds and attacks. TryHackMe lists a SOC Simulator and a Threat Hunting Simulator for business teams; the pages we read do not describe which commercial tools they use.

There are three distinct models here, and buyers should know which one they are paying for:

Generic tooling: open-source or simulated tools that teach method.
Commercial tools in the vendor's environment: the same products your team uses, in an instance the vendor runs.
Your own stack or a replica of it: exercises that run in or against your production tools, or on a copy of your network with the same tools, testing your actual detections and configurations.

What does tool-native training change?

Transfer, first. Practice on the console you use at work removes one source of delay in a real incident. It also changes what an exercise can find. An exercise on your own stack can expose a detection that does not fire or a log source that is missing, which no generic lab can. That turns training into a test of your controls as well as your people.

What should you check before running exercises on your own stack?

The closer an exercise gets to production, the more questions it raises:

Whose instance does it run in, and what permissions does the platform need?
What can the simulated attack touch, and what stops it spreading beyond the exercise scope?
How are test artefacts, accounts and alerts cleaned up afterwards, and how are they kept out of real incident queues?
Who on your side approves each exercise, and is the change process involved?

Ask the vendor for these answers in writing before the first exercise.

Does this matter for crisis exercises too?

In a different way. Crisis exercises do not run attacks against your tools, but realism still comes from your environment. Reflex Security, for example, describes building the scenario from the organisation's public footprint and optional telemetry, with org context listed as AWS, GitHub, Cloudflare and six more. The principle is the same: practice that looks like your organisation transfers better.

What should a SOC lead do next?

List the three tools your analysts spend most time in, and ask each shortlisted platform which of the three models above it offers for each tool. A range that trains on your actual SIEM and EDR is worth more to most teams than a larger library on tools they never use.

The cyber range guide shows which platforms sell a team range and how they describe it.