Contain · incident response game
Think you could handle an incident? Prove it.
An attacker is already inside. The clock starts the moment you do. Contain them before the data leaves the network.
Skip to the modesHow to play. Speed wins, guessing costs.
About a minute a round. Works with a mouse or a thumb.
01
Triage the alerts
Alerts light nodes amber on the map and in the telemetry feed. Some are the attacker. Some are ordinary Tuesday noise.
02
Investigate
Takes two seconds. Confirms whether an alert is real, tells you the right response, and turns up leads: where the attacker went next.
03
Respond
Pick the response that fits. A stolen session needs its sessions revoked, not the account disabled. Cut off the next hop before they reach it.
04
Declare contained
Once every foothold is neutralised, including the persistence you had to dig for, call it. That stops the clock.
You win
When you declare contained with nothing left active. Your score is the clock plus penalties, lowest first.
You lose
If the exfiltration bar reaches 100%. Cutting off the data source or the destination stops it.
Penalties
- +5s
- A response on a node that didn’t need it, or the wrong response
- +2s
- Neutralising a compromised node before investigating it
- +10s
- Declaring contained while the attacker still has a foothold
Controls
- Click / tap
- select a node, or an alert in the feed
- N
- jump to the next alert nobody has looked at
- I
- investigate the selected node
- 1 · 2
- respond
- Drag · scroll
- tilt and zoom the board
Tip: investigating a confirmed node is how you find the ones that haven't alerted yet.
Daily Incident
Everyone gets the same incident today. One ranked attempt.
Today's record: —
Quick Play
A fresh incident every time. Play as often as you like.
Hard Mode
More hosts, noisier telemetry, a faster attacker and simultaneous alerts.
The boards
Same incident, everyone, every day.
A new Daily Incident goes live at midnight UTC. Everyone gets the same network, the same attacker and the same decoys, so the daily board is a straight race. You get one ranked attempt; after that you can practise it as often as you like.
Quick Play and Hard Mode generate a fresh incident every round and keep your best time on an all-time board. Hard Mode has more hosts, noisier telemetry, alerts landing on top of each other and an attacker who moves twice as fast.
Post anonymously with a generated name, or join the Weekly Brief to put your own callsign on the board.
Times are checked on the server: it replays every run through the same engine you played, so the only way onto the board is to actually contain the incident.