Blue vs Red

A defensive capture-the-flag

0 / 0 Score

0 / 0 Solved

0% complete

—

Pick a challenge to read the briefing, grab the evidence, and submit a flag.

Blue vs Red: Ghost in the Assistant — a synthetic, defensive security exercise. All logs, hosts, users, and indicators are fictional. There is nothing to attack and no real systems are involved: your job is to read the evidence like an analyst and report what happened.

Flags are checked in your browser. Progress is saved only on this device. Use Export to hand your results to the organizers. This is an honor-system portal — see the organizer README for running a scored, proctored event.

MISSION

Blue vs Red

Incident: “Ghost in the Assistant” · Northbridge Logistics SOC

You're a blue-team analyst in the Security Operations Center at Northbridge Logistics. Overnight, alarms started firing. Something moved through the network — from a single stolen login all the way to the company's new AI security assistant, SecAssist.

Leadership needs answers. You have the logs the attacker left behind: sign-ins, endpoint telemetry, network captures, and the AI assistant's own activity trail. Work the case across 8 phases of the attack — from the first quiet beacon to the final cover-up — and capture a flag at each step by reporting the exact piece of evidence you found.

Flags look like BVR{phase.challenge.evidence}. The evidence comes straight out of the logs — click Flag guide any time for the rules.

Choose your track

You can switch tracks anytime from the top bar. Your progress is saved per track on this device.

REFERENCE