ServiceNow · SIR Range · Get started
Deploy the range to your ServiceNow PDI.
Import one update set into a free ServiceNow Personal Developer Instance, type in your scoreboard email and the class key, and start triaging live Security Incident Response cases.
How it works
Register & log in
Create your scoreboard account so your flags and score are tracked to you.
Get the update set
Download it from the start page. One file, the same for everyone — nothing in it is specific to you.
Import to your PDI
In ServiceNow: Retrieved Update Sets → Import from XML, then preview & commit. Full guide →
Run & triage
Set Handle to your scoreboard email and Enrollment token to the class key, click Run, then submit what you uncover for points on the live leaderboard.
Choose an operation
Operation Quiet Harbor
A competitive, self-paced CTF across the full attack lifecycle — phishing, malware, lateral movement, exfiltration, and campaign correlation. 50 challenges, live scoreboard.
Get started →Operation Deep Current
Triage a live SOC queue of five unrelated real-world incidents — a DPRK fake IT worker, ransomware living-off-the-land, a poisoned software supply chain, AI deepfake CFO fraud, and a home-network botnet. 31 challenges, grounded in open-source threat intelligence.
Get started →Operation Undertow
A mid-stream breach where detection fired late and nothing is pre-verdicted. Every flag is a salience inversion — the answer is the option your instincts steer you away from, overturned only by a bright-line record fact. 9 challenges.
Get started →Operation Watchtower
A guided, five-scenario SIR implementation loop — start an incident, work it with an auto-enriched playbook, solve the matching challenge, resolve, and the next scenario appears. Built for enablement and demos.
Get started →Two things to remember. Your handle is the email you register with here — type it exactly, or your captures score against the wrong account. The update set seeds the incidents into your PDI; it does not report your answers back, so you still submit each flag on the challenge page. Every incident we create is tagged with its operation name, and ServiceNow Range → My Range Incidents lists only ours.