▸ Terminal
type an action in plain English — the engine interprets and rules on it
▸ Inbox
messages to and from in-exercise participants & agents only
▸ Team Chat
your response team — human seats and AI role-agents
#incident-response#soc#leadership
▸ Timeline
everything you're aware of, in order — hidden activity stays hidden
▸ Artifacts
evidence & files your investigation turns up — shared with the whole team
▸ Network Map
your known environment — a machine reads "compromised" only once your team confirms it
Connect to a live exercise
Point at a running engine (python cli.py --serve). Leave blank to keep exploring the demo.
Take a seat
Every seat sees the same incident at a different altitude — the SOC analyst reads indicators, the CEO hears business impact. Pick the one you're playing.
Seats held by someone else are locked. A seat
run by the engine can be taken over at any time.
Prompt the Moderator
Say in plain English what to bring into the exercise. The Moderator works out whether it's a new system, a piece of evidence, or a message — and builds it.
Systems land on the network map · evidence lands in Artifacts · messages land in the inbox. Anything you add can be undone.