Unlock Logic
ThreatLab uses a position-based unlock model so you always know exactly what to work on next:1
Position 0 is always unlocked
The first exercise in any path is immediately available when you join the path. No prior completion is required.
2
Each subsequent exercise unlocks when the previous one is completed
Once you submit all required artifacts for an exercise, the next position unlocks automatically.
3
Inactive exercises are skipped automatically
If an exercise is retired mid-path, ThreatLab treats it as completed for unlock purposes. You are never blocked by an exercise you cannot access.
Progress Model
ThreatLab calculates your progress through a path using three counters and a percentage:
Progress is based on active exercises only, so retiring a scenario you have not yet attempted does not leave your percentage stuck below 100%.
Curated and Onboarding Flags
Paths can be promoted with two special flags to control how they surface across the platform:Curated
Marks the path as editorially featured. Curated paths appear prominently on the ThreatLab dashboard so analysts can find recommended content at a glance.
Onboarding
Flags the path as introductory material. Onboarding paths are suggested automatically to newly registered users to give them a structured starting point.
Toggling either flag requires the Curate learning paths (
curate_paths) capability. Standard analysts cannot promote or demote paths.Validation Rules
When creating or updating a learning path, ThreatLab enforces the following constraints:
Attempting to save a path that violates any of these rules returns a validation error listing each field that needs attention.