Cybrary ForgeCYBRARY / FORGE
Back to Replay Theater
Back to ForgeCybrary / Replay Theater

Replay Theater

Four recorded runs, from one analyst working a single endpoint up to two teams racing the same estate. Scrub any of them: every screen, alert and point you see was produced by the same engines that score a live run.

SOAR response — automation acts, the analyst approves

11:30 · 23 logged actions · 3 alerts

Chapter-by-chapter walkthrough with the pivotal moves called out and coached.

00:00 / 11:32

Triage — what to notice: Watch what they looked at before touching anything — the order of the first three reads usually predicts the whole run.

Participant screens

3 seats · split screen
forge-soarSystem
Desktop
  1. — idle desktop, nothing done yet —
0 actionsno activityDesktop
ternIncident lead
Desktop
  1. — idle desktop, nothing done yet —
0 actionsno activityDesktop
unattributedRed operator
0 actionsno activityDesktop

Screens are re-rendered from each seat's recorded window track at the cursor — the real layout they had open, reconstructed from state rather than captured as video. Runs recorded before the screen track fall back to a summary of the action log.

  1. Before the first logged action.

Score accrual

Points as they were earned, sampled every 30 seconds of run time.

Standing at 00:00

  1. 1tern0 actsfp 00
  2. 2forge-soar0 actsfp 00

Alerts fired (0/3)

Nothing has tripped a correlation rule yet.

Automation queue

No playbook has been bound yet — automation reacts to the alerts above.

Who was in the room

  • tern75 pts

    On-call analyst

    5 actions · 1 decisive · noise 0

  • forge-soar110 pts

    Forge SOAR

    8 actions · 3 decisive · noise 0

  • unattributed0 pts

    Simulated adversary

    10 actions · 0 decisive · noise 75

Zoom into any seat in the replay above to watch that person's console on its own, or leave the grid up to see who was reading while someone else pulled the trigger.

How the run scored

616 / 940

Elite100% outcome · rs-2
Scoping100%

4/4 found

Containment100%

3/3 found

Chain reconstruction100%

4/4 found

Gap handling100%

1/1 found

  • Automation contained the first two stages before the on-call analyst was even awake.
  • The irreversible step — disabling the service account — correctly waited for a human approval.
  • Mean time to containment was under four minutes, against a 30-minute target.

Simulated environment. No real systems, customers or people appear in these recordings. Browse the activity library →