For threat intelligence

Collect against a world that answers back.

Threat intelligence on the Range is collection with a purpose. Operation Glass Harbor and the wider simulated internet give analysts actor infrastructure, underground personas, campaigns, and indicators they have to evaluate before an assessment is finished.

Capabilities

  • Collection

    Work an intelligence requirement across the simulated internet.

  • Actor infrastructure

    Map domains, hosting, certificates, and the records that tie them together.

  • Underground personas

    Read simulated forums, marketplaces, and actor pages as sources.

  • Campaigns

    Group activity into a narrative the evidence can actually carry.

  • Indicators

    Develop indicators from the investigation, with the context still attached.

Method

How Cybervestigate Works

Five stages, from the first briefing to the debrief against ground truth.

  1. 1

    Receive the case

    The learner receives an allegation, intelligence requirement, incident report, victim complaint, or briefing.

  2. 2

    Investigate

    They search Cybervestigate's simulated internet, collect evidence, interrogate records, correlate identities, examine artifacts, and request information.

  3. 3

    Analyze

    Build timelines, link entities, document hypotheses, evaluate sources, and identify gaps.

  4. 4

    Report

    Write findings and assessments supported by evidence.

  5. 5

    Debrief

    Compare decisions with the scenario ground truth and receive feedback.

Begin with the case.

Operation Glass Harbor is the investigation. The debrief comes after the work.

Start Investigating Train Your Team