ServiceNow · SIR Range
Security Incident Response,
hands-on.
Play the hosted capture-the-flag, or deploy a ready-made SIR operation to your own ServiceNow instance.
Lab ready — open Challenges →
Operations
Operation Quiet Harbor
A competitive, self-paced CTF across the full attack lifecycle — phishing, malware, lateral movement, exfiltration, and correlation. Live scoreboard.
Operation Deep Current
Triage a live SOC queue of five unrelated real-world incidents — a DPRK fake IT worker, ransomware living-off-the-land, a poisoned software supply chain, AI deepfake CFO fraud, and a home-network botnet. Grounded in open-source threat intelligence.
Operation Undertow
A mid-stream breach where detection fired late and nothing is pre-verdicted. Every flag is a salience inversion — the answer is the option your instincts steer you away from, overturned only by a bright-line record fact.
Operation Ballast
Triage a change risk register instead of an incident queue — quantify the fleet's high-risk changes, spot the one riding lowest in the water, and catch the governance condition that actually decides it.
Operation Bulkhead
Triage a compliance and audit program instead of a change register — chase a failing control to the citation it maps to, spot the exception whose cover is about to lapse, and catch the audit finding that's already overdue.
Operation Riptide
A Risk-discipline governance queue where the loudest record is the wrong answer — the highest-scoring risk, the newest exception, the scariest-titled audit finding are all decoys. Every flag is overturned only by a bright-line record fact: a ceiling, a valid-to date, an approver identity.
Operation Watchtower
A guided, five-scenario SIR implementation loop — START an incident, work it with an auto-enriched playbook, solve the matching challenge, resolve, and the next scenario appears. Built for enablement and demos.