ServiceNow SIR Range — Deploy to your PDI

Import ServiceNow Range

One Import from XML on your PDI — no SDK, no CLI. Installs the whole platform, with all four operations as records.

Pick an operation

A competitive CTF, or a guided implementation workshop. Choose one from ServiceNow Range → Operations.

Run it

Fill the operation's config and click Run. Challenges live on the hosted CTFd server; the workshop's are already visible.

Select an operation

Operation Quiet Harbor

SIR Capture the Flag

A competitive, self-paced CTF. Investigate realistic SIR incidents on your PDI and capture flags across the full attack lifecycle — phishing, malware, lateral movement, exfiltration, correlation, and triage.

Best forHands-on analysts practising investigation under a scoreboard
Format50 flag challenges · one answer key per cohort
Scopex_snc_range · Operation Quiet Harbor
SetupLight — fill 2 fields on the operation record, click Run (no OAuth)

Select this operation

Operation Deep Current

SIR Capture the Flag · Real-World Threats

A competitive CTF built from real-world threats. Triage a queue of five unrelated SIR incidents — a DPRK fake IT worker, ransomware living-off-the-land, a poisoned software supply chain, AI deepfake CFO fraud, and a home-network botnet — grounded in open-source threat intelligence.

Best forAnalysts triaging current, real-world attack scenarios under a scoreboard
Format31 flag challenges · one answer key per cohort
Scopex_snc_range · Operation Deep Current
SetupLight — fill 2 fields on the operation record, click Run (no OAuth)

Select this operation

Operation Undertow

SIR Capture the Flag · Expert / Salience Inversion

The expert cut. A breach discovered mid-stream — detection fired late, nothing is pre-verdicted, the tools disagree. Every flag is a salience inversion: the answer is the option your instincts steer you away from, overturned only by a bright-line record fact.

Best forSeasoned analysts who want their pattern-matching tested, not just their navigation
Format9 flag challenges · one answer key per cohort
Scopex_snc_range · Operation Undertow
SetupLight — fill 2 fields on the operation record, click Run (no OAuth)

Select this operation

Operation Watchtower

SIR Implementation Workshop

A guided, narrative incident-response loop. Press START and a SIR incident appears — auto-enriched, with a playbook. Solve the matching challenge, resolve the incident, and the next scenario reveals itself. Five in a row.

Best forEnablement & demos — showing how SIR implementation works end to end
Format5 scenarios · easy / medium / hard
Scopex_snc_range · Operation Watchtower
SetupLight — incidents generate on-platform; CTFd just reveals challenges

Select this operation

↑ Select an operation to get its update set and deploy steps.

Operation Quiet Harbor

SIR Capture the Flag · ServiceNow Range (x_snc_range)

What you'll deploy

A scoped app that seeds a full SIR incident queue on-platform, with action-gated reveals. Flags are graded by the hosted range service against the values seeded into your own instance, and rotate between cohorts.

Two things to have ready Your handle is the exact email you register with on the scoreboard, and your class key is the short code your instructor shares. You type both onto the operation record before clicking Run — get the handle right and your captures score against the right account. Your PDI just needs Security Incident Response + Threat Intelligence activated.

1 · Register on the scoreboard

Create your player account (Register, top-right) — the email you register with is your handle. Your PDI's flags are tied to it, so do this before you download.

2 · Get the update set

The ServiceNow Range update set

x_snc_range · one file, the same for everyone · installs every operation

Get the update set →

Opens the start page, which also shows the two values to type in step 3.

3 · Install & run

Activate plugins (if not already): Security Incident Response, Threat Intelligence.
Import: All → Retrieved Update Sets → Import Update Set from XML → upload the file → Upload.
Preview & commit: open the loaded set → Preview Update Set → resolve any problems → Commit Update Set.
Open ServiceNow Range → Operations → Operation Quiet Harbor, set Handle to your scoreboard email and Enrollment token to the class key, then click Run.

4 · Play

Work the incident queue on your PDI and submit what you uncover for points on the live leaderboard.

Scoreboard → /scoreboard · Challenges → /challenges?op=quiet-harbor

Guides

Player guide — set up and play New to SecOps? SIR field guide

Operation Deep Current

SIR Capture the Flag · Real-World Threats · ServiceNow Range (x_snc_range)

What you'll deploy

A scoped app that seeds your own queue of five real-world SIR incidents on-platform — a DPRK fake IT worker, ransomware living-off-the-land, a poisoned software supply chain, AI deepfake CFO fraud, and a home-network botnet. Flags are graded by the hosted range service against the values seeded into your own instance, and rotate between cohorts.

1 · Register on the scoreboard

Create your player account (Register, top-right) — the email you register with is your handle. Your PDI's flags are tied to it, so do this before you download.

2 · Get the update set

The ServiceNow Range update set

x_snc_range · one file, the same for everyone · installs every operation

Get the update set →

Opens the start page, which also shows the two values to type in step 3.

3 · Install & run

Activate plugins (if not already): Security Incident Response, Threat Intelligence.
Import: All → Retrieved Update Sets → Import Update Set from XML → upload the file → Upload.
Preview & commit: open the loaded set → Preview Update Set → resolve any problems → Commit Update Set.
Open ServiceNow Range → Operations → Operation Deep Current, set Handle to your scoreboard email and Enrollment token to the class key, then click Run.

4 · Play

Work the queue of five real-world incidents on your PDI and submit what you uncover for points on the live leaderboard.

Scoreboard → /scoreboard · Challenges → /challenges?op=deep-current

Guides

Player guide — set up and play New to SecOps? SIR field guide

Operation Undertow

SIR Capture the Flag · Expert / Salience Inversion · ServiceNow Range (x_snc_range)

What you'll deploy

A scoped app that seeds your own mid-stream-breach SIR queue on-platform — detection fired late, nothing is pre-verdicted, and the tools disagree. Every flag is a salience inversion: the answer is the option a seasoned analyst's pattern-matching steers them away from, overturned only by a bright-line fact in the record. Flags are graded by the hosted range service against the values seeded into your own instance, and rotate between cohorts.

1 · Register on the scoreboard

Create your player account (Register, top-right) — the email you register with is your handle. Your PDI's flags are tied to it, so do this before you download.

2 · Get the update set

The ServiceNow Range update set

x_snc_range · one file, the same for everyone · installs every operation

Get the update set →

Opens the start page, which also shows the two values to type in step 3.

3 · Install & run

Activate plugins (if not already): Security Incident Response, Threat Intelligence.
Import: All → Retrieved Update Sets → Import Update Set from XML → upload the file → Upload.
Preview & commit: open the loaded set → Preview Update Set → resolve any problems → Commit Update Set.
Open ServiceNow Range → Operations → Operation Undertow, set Handle to your scoreboard email and Enrollment token to the class key, then click Run.

4 · Play

Work the mid-stream breach queue on your PDI and submit what you uncover for points on the live leaderboard.

Scoreboard → /scoreboard · Challenges → /challenges?op=undertow

Guides

Player guide — set up and play New to SecOps? SIR field guide

Operation Watchtower

SIR Implementation Workshop · ServiceNow Range (x_snc_range)

What you'll deploy

A scoped app that runs the five-scenario workshop entirely on your PDI: it generates auto-enriched SIR incidents (threat intel, observables, timeline, affected CIs, response tasks) and drives Flow Designer playbooks. One button starts it; one button resolves each scenario and advances to the next. The matching challenges are already on the hosted board — no CTFd setup required.

Before you import Your PDI must have Security Incident Response and Threat Intelligence activated. That's the only prerequisite — the app ships a ready-to-run Operation Watchtower record and needs no CTFd token or URL.

1 · Download the update set

servicenow-range.xml

x_snc_range · one app, both operations · Import from XML

Download update set ↓

2 · Install on your PDI

Activate plugins (if not already): Security Incident Response, Threat Intelligence.
Import: All → Retrieved Update Sets → Import Update Set from XML → upload the file → Upload.
Preview & commit: open the loaded set → Preview Update Set → resolve any problems → Commit Update Set.
Run it: ServiceNow Range → Operations → Operation Watchtower → Run. This creates scenario 1 of 5 — Watchtower unlocks one scenario at a time, so a single incident is expected. Click Resolve Scenario on it to complete it and reveal the next. (Difficulty is optional; everything else is pre-set.)

3 · Play

You play the five scenarios right in your PDI — open Operation Watchtower and press Run (step 2 above). They arrive one at a time: resolving each incident creates the next and reveals its challenge. Follow your progress and the matching challenges on the board.

Challenge board → /challenges?op=watchtower

No token, no config Self-service runs with zero CTFd setup — incidents generate on your PDI and the matching challenges are already visible on the hosted board. The “reveal as you reach each scenario” effect is an optional facilitated mode (an admin token set on the Operation Watchtower record’s Configuration section); never needed for self-service.

Guide

Operator guide — run it start to finish