Security · Harvest Hall B · Simulated
Blacksite.
Syntax Energy keeps its billing, its harvest scoring and its certificate archive in one data hall. Marketing named it Blacksite because it sounded secure. You are eleven weeks into the job, the senior on-call is asleep, and leadership has your number.
Incident briefing · INC-0442
The Unusual Connection.
At 02:19 the monitoring stack raised INC-0442. app-02, an internal tooling server in Harvest Hall B, is holding a sustained connection to a machine nobody recognises.
Nothing is down. The Bill Portal is taking payments and the scoring cluster is busy, which is exactly why this is easy to get wrong: the obvious moves here are the ones that cause the outage.
Work out what the connection is, what it has already taken, and shut it down without breaking anything customers touch. Collect evidence before you change the state of a host.
- Investigate from the shell. Real commands against fictional hosts:
connect,netstat,ps,cat,logs,analyze. Evidence is logged when you find something that matters. - Contain without collateral. Change control refuses containment until you have a finding. Isolating keeps memory; powering off destroys it. Two hosts here are customer-facing, and the suspect is not one of them.
- Leadership will call. Each call pauses the incident clock and wants something. Doing what they ask always pleases them. It does not always help.
You are
Junior Infrastructure Engineer
First night on call. The attack started at 02:19 and it is not waiting for you.
About fifteen minutes. The clock pauses when you switch tabs or a call comes in.
Harvest Hall B: billing, the harvest scoring cluster, the certificate archive, and one internal server that has started talking to a stranger.
Career
Junior Infrastructure Engineerheld
Read-only investigation, basic containment with evidence.
Data Centre TechnicianC+
Hands on hardware: power, cooling, replacement, capacity.
Systems AdministratorB+
Host-level authority: services, packages, accounts.
Network EngineerB+
Owns segmentation, routing and firewall policy.
Security Operations AnalystA+
Runs detection, triage and threat intelligence.
Incident ResponderA+
Leads containment, eradication, recovery and disclosure at facility scale.
Infrastructure Automation EngineerS+
Codifies response and guardrails so the same incident cannot recur.
AI Infrastructure and Reliability EngineerS+
Keeps the scoring fleet and its data pipeline safe and available.
Roles are earned on demonstrated competence, one rung per incident. Your career is kept in this browser only.
Everything is simulated in your browser. No real network is touched, no commands leave the page, and every host, address, account and secret is invented. The incident response is real: the techniques, the evidence and the mistakes are the ones that happen in actual breaches.