Not another red-team CTF. This one rewards defenders — the sharpest detection, the fastest containment, the cleanest remediation report.
The scenario
Teams work through a live simulated intrusion in a mock enterprise environment — SIEM feeds, endpoint telemetry, network traffic. Points are awarded for detection speed, correct scoping, containment quality and the clarity of the post-incident write-up.
- SOC-style setup: dashboards, tickets, chat channel with a "customer".
- Judges score both the technical work and the incident-report craft.
- Category prizes for fastest detection, cleanest remediation and best write-up.