ServiceNow · SIR Range · Get started
Deploy the range to your ServiceNow PDI.
Import one update set into a free ServiceNow Personal Developer Instance, type in your scoreboard email and the class key, and start triaging live Security Incident Response cases.
Your lab is ready
The ServiceNow lab instance URL and credentials are on your instructor's slide — log in there, then open Challenges here and start solving.
Open the lab instance → Open Challenges →How it works
Register & log in
Create your scoreboard account so your flags and score are tracked to you.
Get the update set
Download it from the start page. One file, the same for everyone — nothing in it is specific to you.
Import to your PDI
In ServiceNow: Retrieved Update Sets → Import from XML, then preview & commit. Full guide →
Run & triage
Set Handle to your scoreboard email and Enrollment token to the class key, click Run, then submit what you uncover for points on the live leaderboard.
Choose an operation
Operation Quiet Harbor
A competitive, self-paced CTF across the full attack lifecycle — phishing, malware, lateral movement, exfiltration, and campaign correlation. 50 challenges, live scoreboard.
Get started →Operation Deep Current
Triage a live SOC queue of five unrelated real-world incidents — a DPRK fake IT worker, ransomware living-off-the-land, a poisoned software supply chain, AI deepfake CFO fraud, and a home-network botnet. 31 challenges, grounded in open-source threat intelligence.
Get started →Operation Undertow
A mid-stream breach where detection fired late and nothing is pre-verdicted. Every flag is a salience inversion — the answer is the option your instincts steer you away from, overturned only by a bright-line record fact. 9 challenges.
Get started →Operation Ballast
Triage a change risk register instead of an incident queue — quantify the fleet's high-risk changes, spot the one riding lowest in the water, and catch the governance condition that actually decides it. 50 challenges.
Get started →Operation Bulkhead
Triage a compliance and audit program instead of a change register — chase a failing control to the citation it maps to, spot the exception whose cover is about to lapse, and catch the audit finding that's already overdue. 31 challenges.
Get started →Operation Riptide
A Risk-discipline governance queue where the loudest record is the wrong answer — the highest-scoring risk, the newest exception, the scariest-titled audit finding are all decoys. Every flag is overturned only by a bright-line record fact: a ceiling, a valid-to date, an approver identity. 9 challenges.
Get started →Operation Watchtower
A guided, five-scenario SIR implementation loop — start an incident, work it with an auto-enriched playbook, solve the matching challenge, resolve, and the next scenario appears. Built for enablement and demos.
Get started →Two things to remember. Your handle is the email you register with here — type it exactly, or your captures score against the wrong account. The update set seeds the incidents into your PDI; it does not report your answers back, so you still submit each flag on the challenge page. Every incident we create is tagged with its operation name, and ServiceNow Range → My Range Incidents lists only ours.