An online simulator that offers a collection of real-life cases from the Standoff Cyberbattle

Standoff Cyberbones is an online simulator that offers a collection of real-life cases from the Standoff Cyberbattle.
You can investigate incidents at your own pace to better understand how to detect and respond to cyberthreats and apply this experience later at work.
# Getting started
1.	If you don't have an account yet, [register on the Standoff 365 Platform](https://auth.standoff365.com/en-US/account/registration/).
2.	Read the [step-by-step instructions](https://help.standoff365.com/en-US/7170815371/portal) on how to set up a connection to Standoff Cyberbones.
3.	Go to Workspace → [Access and resources](https://range.standoff365.com/en-US/battle/16/?section=report&tab=accessAndResources), and download a VPN config file.

# Viewing tasks
1.	Log in to the [Standoff 365 Platform](https://auth.standoff365.com/en-US/account/login/).
2.	Go to the [Standoff Cyberbones page](https://range.standoff365.com/en-US/battle/16). 
3. Select Workspace → [Practical tasks](https://range.standoff365.com/en-US/battle/16/?section=report&tab=practicalTasks). 

# Completing tasks
You can find answers to all tasks in Positive Technologies security tools, which store logs and artifacts from the Standoff Cyberbattle.
If you don't have any experience with Positive Technologies products, read the following materials:
*	 [MaxPatrol SIEM Quick Start Guide](https://storage.ptsecurity.com/f/d974809c9b1545dfa4a0/)
*	 [PT NAD Quick Start Guide](https://storage.ptsecurity.com/f/def8b6340c0746089617/)
*   [PT AF Quick Start Guide](https://storage.ptsecurity.com/f/5b8dfbd4f36b42b882ba/)

Please note:
• To connect to MaxPatrol SIEM, select the LDAP tab in the authorization window.
• For authorization in PT AF, use the SSO tab.
• Don't forget to turn on VPN to complete tasks and work with security tools.

Note: The security tools contains logs and artifacts from the Standoff Cyberbattle that took place in November 2022. To display investigation data displays correctly, use the time filter — the required period is specified in each task.
Important: Event timestamps in MaxPatrol SIEM depend on your time zone. For example:
An event recorded in SIEM at 10:00 UTC+0 will appear as:
- 05:00 UTC-5 (New York)
- 11:00 UTC+1 (Berlin)
- 15:30 UTC+5:30 (New Delhi)
- 19:00 UTC+9 (Tokyo)
Adjust the filter according to your local time to avoid discrepancies

# Getting support
If you encounter technical difficulties or have any questions about the Standoff Cyberrange, write to our [Telegram bot](https://t.me/stf_def_support_bot).

cyberbones

Standoff Cyberbones (free version)

Submit answers to the tasks below. The number of attempts is unlimited.

В Государстве F активно развивается нефтегазовая компания Tube. В ее владении находятся объекты, связанные с нефтедобычей, нефтепереработкой, хранением, транспортировкой и сбытом нефтепродуктов. Также среди ее активов есть автоматизированная газораспределительная станция (АГРС), которая снабжает ТЭЦ и Сити природным газом. От работы станции зависят стабильное отопление и горячее водоснабжение жилого фонда в столице, а также обеспечение электроэнергией большинства регионов, в которые поступает электричество с ТЭЦ.
Чтобы увеличить объемы добычи ископаемых, Tube активно расширяет свою ресурсную базу за счет геологоразведочных работ и новых приобретений. На территории Государства F сосредоточено порядка 10% мировых запасов нефти, что позволяет экспортировать ресурс.

Tube (2022)

Исследуй самые интересные инциденты, выявленные в ходе кибербитвы Standoff 2022

Heavy Logistics manages transport infrastructure and operates the traffic light system in State F. The company is also in charge of airport customs, a temporary storage warehouse, an airport express train station, and an automated parking facility for airport visitors and passengers.

State F will face catastrophic consequences if hackers break into Heavy Logistics systems and seize control. For example, they could cause a passenger information system failure or flight delays, disrupt traffic, or cause trains moving on the same track to crash.

Heavy Logistics (2022)

Explore the most interesting incidents detected during the Standoff Cyberbattle 2022

City Housing & Utilities specializes in providing communal and public services in State F. The company maintains street lighting, CCTV systems, digital billboards, and public transport while also managing shopping and business centers, parking lots, a multifunctional public service center, and information desks. In addition, it equips residential apartments with IoT devices and connects them to the city's broadcasting network.

Cyberattacks on the company could affect people in the city significantly, leaving them without online pharmacy orders, street lighting, and access to public services, or even locking them in their apartments.