Cybrary ForgeCYBRARY / FORGE
Back to Replay Theater
Back to ForgeCybrary / Replay Theater

Replay Theater

Four recorded runs, from one analyst working a single endpoint up to two teams racing the same estate. Scrub any of them: every screen, alert and point you see was produced by the same engines that score a live run.

Team hunt — three seats, one intrusion, live

13:20 · 42 logged actions · 5 alerts

Chapter-by-chapter walkthrough with the pivotal moves called out and coached.

00:00 / 13:22

Triage — what to notice: Watch what they looked at before touching anything — the order of the first three reads usually predicts the whole run.

Participant screens

3 seats · split screen
kestrelIncident lead
0 actionsno activityDesktop
shrikeRed operator
Desktop
  1. — idle desktop, nothing done yet —
0 actionsno activityDesktop
wrenDefender
Desktop
  1. — idle desktop, nothing done yet —
0 actionsno activityDesktop

Screens are re-rendered from each seat's recorded window track at the cursor — the real layout they had open, reconstructed from state rather than captured as video. Runs recorded before the screen track fall back to a summary of the action log.

  1. Before the first logged action.

Score accrual

Points as they were earned, sampled every 30 seconds of run time.

Standing at 00:00

  1. 1kestrel1 actsfp 00
  2. 2wren0 actsfp 00
  3. 3shrike0 actsfp 00

Alerts fired (0/5)

Nothing has tripped a correlation rule yet.

Automation queue

No playbook has been bound yet — automation reacts to the alerts above.

Who was in the room

  • kestrel65 pts

    Incident lead

    7 actions · 4 decisive · noise 0

  • wren80 pts

    Defender, SIEM

    7 actions · 1 decisive · noise 0

  • shrike0 pts

    Red operator

    28 actions · 0 decisive · noise 99

Zoom into any seat in the replay above to watch that person's console on its own, or leave the grid up to see who was reading while someone else pulled the trigger.

How the run scored

742 / 940

Elite97% outcome · rs-2
Scoping100%

5/5 found

Containment100%

4/4 found

Chain reconstruction89%

4/5 found

Gap handling100%

2/2 found

  • The room found every pivot the red operator made, and revoked access before exfiltration completed.
  • Nobody claimed the persistence mechanism, so the last chain stage went unscored.
  • Both planted blind spots were named, which is why the egress claim survived review.

Simulated environment. No real systems, customers or people appear in these recordings. Browse the activity library →