Attack-and-defend progressions. Replay a real kill chain, then triage the SOC alerts it generated — including the one tuned to the wrong stage.
Attacker VM 10.10.14.2 works a target from recon through a foothold on 10.10.10.5. Watch the same kill chain from both terminals, then work out which SOC alerts actually earned their severity.
A lateral-movement detection rule lights up during a recon sweep, not during any actual lateral movement. Work out why it fired, and what it actually caught.
An auto-remediation policy kills a webshell the instant it's detected. That's the problem: work out what it cost, and when immediate containment is actually the right call instead.
A legacy server segment has no EDR coverage at all, and a burst of failed logins turns out to be partly the org's own vulnerability scanner. Separate the real compromise from both.