ServiceNow · SIR Range
Security Incident Response,
hands-on.
Play the hosted capture-the-flag, or deploy a ready-made SIR operation to your own ServiceNow instance.
Operations
Operation Quiet Harbor
A competitive, self-paced CTF across the full attack lifecycle — phishing, malware, lateral movement, exfiltration, and correlation. Live scoreboard.
Operation Deep Current
Triage a live SOC queue of five unrelated real-world incidents — a DPRK fake IT worker, ransomware living-off-the-land, a poisoned software supply chain, AI deepfake CFO fraud, and a home-network botnet. Grounded in open-source threat intelligence.
Operation Undertow
A mid-stream breach where detection fired late and nothing is pre-verdicted. Every flag is a salience inversion — the answer is the option your instincts steer you away from, overturned only by a bright-line record fact.
Operation Watchtower
A guided, five-scenario SIR implementation loop — START an incident, work it with an auto-enriched playbook, solve the matching challenge, resolve, and the next scenario appears. Built for enablement and demos.