← Back to startWelcome to ServiceNow Security Incident Response (SIR) Capture-the-Flag. A simulated intrusion (or queue of incidents) has been pushed into your own ServiceNow instance. Your job: triage the incidents, pull out the indicators, and submit them as flags to score on the live leaderboard.
Every answer is unique to you — flags are derived per player, so they can't be shared.
PDIs are reclaimed after ~10 idle days — sign in every few days to keep yours alive.
Open the scoreboard URL from your instructor — it lands on the Get started page — and create an account (or log in if you already have one). The email you register with is your handle; the page carries you straight back here once you're signed in, ready for the next step.
The update set seeds the incidents into your PDI. It does not report your answers back to the scoreboard — you still submit each flag on the challenge page yourself.
In your PDI, open All → ServiceNow Range → Operations and select the operation you chose. For the three scored CTF operations (Quiet Harbor, Deep Current, Undertow), fill in two fields:
| Field | What to enter |
|---|---|
| Handle | The email you registered with on the scoreboard — exactly. This is what links your captures to your account. |
| Enrollment token | The class key your instructor shares in chat. |
The Range URL is already filled in. Click Run, and your security incidents are created right in your SIR queue. (Re-run any time — it won't create duplicates.)
Not sure it worked? Go back to the Get started page and click Check my setup — it tells you whether your PDI reached us.
Playing Operation Watchtower? It's a different kind of operation — a guided, self-paced SIR workshop, not a scored CTF queue. It has no Handle/Enrollment Token fields; clicking Run creates the first of five scenarios one at a time, and you advance by clicking the Resolve Scenario button on each incident (which closes it and reveals the next). Full walkthrough: your operation's panel on the Deploy to your PDI page links the Watchtower guide.
Open your Security Incident list (All → Security Incident → Incidents). You'll find your incidents — the shape and scope depend on which operation you chose.
Example (Operation Quiet Harbor): five linked incidents — a phishing email that becomes malware, lateral movement, data exfiltration, and a campaign-correlation review. Deep Current and Undertow use different incident queues; see your operation's panel for details. Watchtower shows one incident at a time — work it, click Resolve Scenario, and the next appears (five in all).
For each challenge on the scoreboard, find the answer in your incidents and submit it. Indicators live in:
Answers are case-insensitive everywhere — upper case, lower case or mixed all grade the same — and surrounding quotes, stray spaces and a trailing full stop are ignored. What still has to be right is the value itself: a count must be the right number, and a size in GB must use the binary convention stated on the card.
Operation Quiet Harbor has two answers that stay hidden until you trigger an action:
If you're playing Deep Current or Undertow: your operation has no gated-reveal buttons. Every flag is readable directly from the incident record once you've imported your update set and run the operation.
Q: I get an error "Fill in Handle, Enrollment Token and Range URL…"
A: When you click Run on your chosen operation record, three fields must be filled: Handle, Enrollment Token, and Range URL. If you: - Handle — paste your scoreboard email. - Enrollment Token — paste the class key your instructor shared, exactly as given. - Range URL — already filled in by the update set; if it's blank, re-import.
Q: I get "Could not fetch scenario (403/…). Check Range URL, Enrollment Token and Handle."
A: The Run button couldn't reach the control server or the token was rejected. Check:
- Range URL is exactly what your instructor told you (usually https://<domain>/range).
Copy it carefully; a typo like https://domain/rage fails silently.
- Enrollment Token matches the class key exactly (it's case-insensitive, but must be
the right code). If your instructor has ended the class, the key stops working — ask
for the current one.
- Handle is your exact scoreboard email, lowercase. For example, if you registered as
Alice@Example.com, the handle must match exactly (case-insensitive on entry, but the
setup needs to match your login).
Q: I imported the update set, but the incidents don't appear when I click Run.
A: The most common cause is that Security Incident Response or Threat Intelligence are not activated on your PDI. Even if the import succeeds with no errors, the SIR tables won't exist and the incidents won't render. Fix: In your PDI, open All → Application Manager (or All Available Applications), search for Security Incident Response, and click Install. Threat Intelligence installs alongside it. Sign out and back in, then try Run again.
Q: My handle doesn't match the scoreboard and the flags won't grade.
A: The scoreboard email and the Handle field on your operation record must match exactly. Sign in to the scoreboard, and the Get started page shows your handle at step 1 — copy it from there into the operation record, then click Run again. Nothing needs re-importing; correcting the field and re-running is enough.
Q: I clicked "Run Sandbox Detonation" or "Get Containment Receipt" but nothing happened. (Quiet Harbor only)
A: This question only applies to Operation Quiet Harbor. Deep Current and Undertow have no gated-reveal buttons; every flag is readable directly in the incident record.
For Run Sandbox Detonation (Quiet Harbor Malware incident): open the incident, find the button, and click it. A new work note appears with the token.
For Get Containment Receipt (Quiet Harbor Exfiltration task): open the task and click the button — the click both closes the task and writes the receipt into its notes. You don't need to (and can't) close the task yourself first; the SIR task form won't let a player close it, so the button does that step for you. If the token doesn't appear, refresh the task record and check the work / close notes.
Q: The app won't let me run it again (I get "Run" button disabled or a permission error).
A: Once an operation reaches Active state, you can't run it again until you clean it up. Open the operation record and click Clean up (or Delete this app if you want to remove it entirely). This retires the old scenario and resets the operation so you can Run a fresh copy. (Cleaning up doesn't delete your flag submissions on the scoreboard.)
Q: I'm out of attempts on a challenge and it won't let me submit anymore.
A: That's the scoreboard's own attempt cap, not a bug — a few challenges limit how many wrong guesses they accept (the "x/y attempts" counter inside the challenge window). Once you hit the cap, that challenge is locked for you. If this happens during a class event, ask your instructor: an admin can clear your wrong attempts from the CTFd admin panel, which unlocks the challenge again.
Q: I forgot my scoreboard password — the "Forgot your password?" link did nothing.
A: This range runs without an email server, so the password-reset email is never sent (the page may still say "check your email" — nothing will arrive). Ask your instructor: a CTFd admin can reset your password directly from the admin panel (Admin → Users → your account → Edit). You keep your solves and score — only the password changes.