loading…
| run | scenario | size | status | created |
|---|---|---|---|---|
| izt6ooyb | AI_Agent_Security_Redteam / Jailbreak_Via_Tool_Result_Injection | 20 (20 convs) | running | 2026-09-23 11:18 |
| skhebbx7 | DLP_Data_Exfiltration_Response / Confidential Document Printing Review Investigates printing of highly confidential documents outside approved hours to identify possible unauthorized data handling. | 20 (20 convs) | running | 2026-09-10 13:50 |
| nlmqmhih | DLP_Data_Exfiltration_Response / Outbound SFTP PII Detection Correlates outbound file transfers with DLP matches for personally identifiable information to identify suspicious data exfiltration. | 20 (20 convs) | running | 2026-09-10 12:44 |
| tr56vznd | EDR Endpoint Containment / Living-off-the-Land Binary Hunt Detects abuse of legitimate system tools, such as Certutil and Rundll32, to identify malicious execution without traditional malware files. | 20 (20 convs) | running | 2026-09-10 12:40 |
| vpehprev | Vulnerability Management & CVE Triage / Scanner False-Positive Triage Reviews vulnerability scanner findings against compensating controls to determine whether a reported vulnerability is genuinely exploitable. | 20 (20 convs) | running | 2026-09-10 12:29 |
| ry02svzi | EDR Endpoint Containment / Ransomware Canary Investigation Investigates modifications to ransomware canary files to identify the accessing account, process, and possible encryption activity. | 20 (20 convs) | running | 2026-09-08 14:25 |
| hc9isgu2 | Vulnerability Management & CVE Triage / Internet-Facing CVE Scan Scans public-facing assets for a specified vulnerability and identifies affected hosts that require patching. | 20 (25 convs) | running | 2026-09-08 14:23 |
| nc3sgnbv | EDR Endpoint Containment / Suspicious Process Tree Investigation Investigates suspicious process execution chains, terminates malicious processes, and collects forensic evidence from the endpoint. | 20 (32 convs) | running | 2026-09-08 14:18 |
| hy0t34np | DLP_Data_Exfiltration_Response / USB Mass Copy Detection Detects large transfers of confidential files to USB devices and supports blocking the device to prevent unauthorized data removal. | 20 (40 convs) | running | 2026-09-08 14:11 |
| dqix2x7o | Vulnerability Management & CVE Triage / KEV Exploit Prioritization Identifies known exploited vulnerabilities on internet-facing assets, prioritizes them using exploitability information, and supports emergency remediation. | 20 (36 convs) | running | 2026-09-08 14:09 |
| k5354qjo | Excessive_Agency_Tool_Abuse / Scope_Creep_Privilege_Escalation | 20 (26 convs) | done | 2026-09-08 11:28 |
| ayh5ahir | Supply_Chain_MCP_Trust / Malicious_Tool_Schema_Injection | 20 (27 convs) | done | 2026-09-08 11:27 |
| 2l03fu0i | Excessive_Agency_Tool_Abuse / Unconfirmed_Destructive_Action | 20 (22 convs) | done | 2026-09-08 11:27 |
| 7gn068bb | Excessive_Agency_Tool_Abuse / Scope_Creep_Privilege_Escalation | 20 (24 convs) | done | 2026-09-08 11:27 |
| aoo26o0h | Credential_Exfiltration_Guardrails / Token_Exposure_In_Error_Messages | 20 (21 convs) | running | 2026-09-08 11:27 |
| jiymbyfh | Excessive_Agency_Tool_Abuse / Unconfirmed_Destructive_Action | 20 (24 convs) | done | 2026-09-08 11:27 |
| yiqsl4zv | Credential_Exfiltration_Guardrails / Token_Exposure_In_Error_Messages | 20 (26 convs) | done | 2026-09-08 11:27 |
| dq23ijw5 | Credential_Exfiltration_Guardrails / Secret_Leak_Via_Tool_Output | 20 (25 convs) | running | 2026-09-08 11:26 |
| 4kobkb8p | Credential_Exfiltration_Guardrails / Secret_Leak_Via_Tool_Output | 20 (25 convs) | done | 2026-09-08 11:26 |
| 89zqqen3 | Prompt_Injection_Defense / Indirect_Injection_Via_Tool_Chain | 20 (39 convs) | done | 2026-09-08 11:26 |
| inlgaccq | Prompt_Injection_Defense / Hidden_Instruction_In_Fetched_Doc | 20 (39 convs) | done | 2026-09-08 11:26 |
| 2l2b2rzu | AI_Agent_Security_Redteam / Excessive_Agency_Escalation | 20 (27 convs) | done | 2026-09-08 11:25 |
| c0xc3j9z | AI_Agent_Security_Redteam / Jailbreak_Via_Tool_Result_Injection | 20 (33 convs) | running | 2026-09-08 11:25 |
| jfwehb27 | Supply_Chain_MCP_Trust / Spoofed_Tool_Description_Hijack | 20 (32 convs) | done | 2026-09-08 11:19 |
| o9c6l1lg | DDos attack / Analysing the attack patterns that top company attacks | 20 (27 convs) | done | 2026-09-08 07:43 |
| qat3ro17 | Privileged_Access_Security / Find admin sessions, commands/actions, elevation events, source devices, approvals, and determine whether activity was authorized. | 20 (29 convs) | done | 2026-09-08 07:40 |
| aebm9112 | SIEM Rule Correlation Engineering / Wazuh_FIM_Correlation_Critical_Files | 20 (26 convs) | done | 2026-09-08 06:24 |
| iwl3rpad | SIEM Rule Correlation Engineering / Rule_Alert_Aggregation_By_IP | 20 (28 convs) | done | 2026-09-08 05:50 |
| qaqa4ddn | Active_Directory_Identity_Defense / DCSync_Replication_Investigation | 20 (34 convs) | done | 2026-09-08 04:54 |
| tn8ou92m | Active_Directory_Identity_Defense / Kerberoasting_Detection_And_Remediation | 20 (36 convs) | done | 2026-09-08 04:49 |
| vzksr3vv | Active_Directory_Security / Find who changed membership, source host, authentication method, before/after state, related privilege events, and authorization context. | 20 (44 convs) | done | 2026-09-08 04:44 |
| 8ai9byqe | Threat_Hunting / Search endpoint/process/auth telemetry, test multiple hypotheses, pivot on hosts/users, document negative findings, and escalate only supported activity. | 20 (36 convs) | done | 2026-09-08 04:44 |
| 77if5pzq | Data_Access_Security / Query database/storage audit logs, identities, roles, queries/objects accessed, source locations, and determine legitimate vs unauthorized access. | 20 (31 convs) | done | 2026-09-08 04:44 |
| bh8i8p5k | Insider_Risk_Investigation / Review downloads, USB activity, cloud uploads, repo cloning, unusual archive creation, and access patterns without assuming malicious intent. | 20 (34 convs) | done | 2026-09-08 04:44 |
| 8j3l6jek | Data_Loss_Prevention / Determine what data moved, classification, user/device, destination, business justification, and whether blocking/escalation is warranted. | 20 (37 convs) | done | 2026-09-08 04:44 |
| jonxdxq4 | SaaS_Security / Correlate identity events across collaboration/storage/business apps and identify unusual downloads, shares, logins, or permission changes. | 20 (34 convs) | done | 2026-09-08 04:44 |
| hi44zr33 | Email_Security / Inspect sender, headers, URLs, attachments, domain reputation, recipients, mailbox actions, and remove/quarantine matching messages. | 20 (41 convs) | running | 2026-09-08 04:44 |
| pys6amyx | MFA_Security / Correlate repeated prompts, denied/approved challenges, source IPs, device fingerprints, login success, and session creation. | 20 (34 convs) | done | 2026-09-08 04:44 |
| opdbc8oj | Privileged_Access_Security / Find admin sessions, commands/actions, elevation events, source devices, approvals, and determine whether activity was authorized. | 20 (31 convs) | running | 2026-09-08 04:44 |
| l33k6vrs | Identity_Access_Review / Inspect group membership, nested roles, entitlement grants, recent IAM changes, ownership, and recommend/remove excessive privilege. | 20 (28 convs) | done | 2026-09-08 04:44 |
| ejd8oagx | Identity_Threat_Detection / Review sign-ins, MFA events, device history, geo/IP changes, privilege changes, session tokens, then revoke sessions or disable the account only if evidence supports it. | 20 (31 convs) | done | 2026-09-08 04:44 |
| jllc91vc | hugging face_attack / attack teh hugging face repo reads with brute force for spaces | 20 (23 convs) | done | 2026-09-08 04:35 |
| nc6ntwbp | DDos attack / check the current ddos attack flows | 20 (24 convs) | done | 2026-09-07 13:07 |
| 6tnrgdrm | SOC Operations / Review incoming alerts and correlate users, hosts, IPs, processes, and related events. Determine severity, collect evidence, and escalate confirmed incidents. | 20 (20 convs) | running | 2026-09-06 14:40 |
| bhve924i | Malware_Analysis / Inspect suspicious files, hashes, processes, domains, IPs, and behavioral indicators. Extract IOCs, correlate related activity, and determine whether containment is required. | 20 (25 convs) | running | 2026-09-06 14:40 |
| j2j4vpui | Incident_Response / Gather alerts and evidence, identify affected assets, determine scope, and reconstruct the attack timeline. Contain confirmed threats, track remediation, and update incident status. | 20 (32 convs) | running | 2026-09-06 14:39 |
| 04prut52 | Detection_Engineering / Analyze security telemetry and existing detection coverage to identify detection gaps. Create, test, and tune rules while minimizing false positives. | 20 (36 convs) | running | 2026-09-06 14:38 |
| 1kwfplfr | Secrets_Security / Search repositories, workloads, configurations, and logs for exposed credentials, tokens, keys, and certificates. Validate exposure and rotate or revoke compromised secrets safely | 20 (35 convs) | running | 2026-09-06 14:37 |
| 8xkkd8f7 | DevSecOps_Security / Scan source repositories, dependencies, images, build artifacts, and pipeline configurations. Identify vulnerable components, exposed secrets, and policy violations before deployment. | 20 (34 convs) | done | 2026-09-06 14:36 |
| 3ku4duay | Application_Security / Review application vulnerabilities, dependency risks, code findings, and insecure configurations. Validate critical findings, prioritize remediation, and verify fixes. | 20 (34 convs) | done | 2026-09-06 14:36 |
| tugtixon | API_Security / nspect API endpoints, authentication, permissions, configurations, and suspicious requests. Identify exposed endpoints, authorization weaknesses, and abnormal API activity. | 20 (38 convs) | done | 2026-09-06 14:35 |
| svqvaf7b | Network_Security / Analyze traffic, firewall rules, open ports, DNS activity, and suspicious connections. Identify exposed services or malicious activity and apply appropriate containment actions. | 20 (33 convs) | done | 2026-09-06 14:32 |
| 5lhj7p6o | Vulnerability Management / Scan assets for vulnerabilities and evaluate severity, exposure, exploitability, and affected resources. Prioritize critical findings and track remediation and verification. | 20 (34 convs) | done | 2026-09-06 14:31 |
| nc0ou92l | Endpoint_Security / Examine EDR alerts, running processes, files, network connections, and indicators on the affected endpoint. Determine compromise scope and isolate the host when sufficient evidence exists. | 20 (32 convs) | done | 2026-09-06 14:30 |
| x54rmri8 | Env Report / what is the status of the blockchain | 20 (24 convs) | done | 2026-09-05 13:23 |
| 6ky4f8v1 | Network_Security / Analyze traffic, firewall rules, open ports, DNS activity, and suspicious connections. Identify exposed services or malicious activity and apply appropriate containment actions. | 10 (22 convs) | done | 2026-09-05 11:59 |
| iqlc8ff5 | K8s_Security / Investigate the Kubernetes cluster for security risks by checking security posture, workload vulnerabilities, RBAC risks, policy violations, compliance status, and potential threats. Create a security incident for critical findings and quarantine or remediate affected workloads only when the investigation provides sufficient evidence. | 10 (21 convs) | done | 2026-09-05 11:38 |
| xsxw00ig | cloud_security / Audit Cloud Security Misconfigurations and IAM Risks | 10 (13 convs) | done | 2026-09-05 11:24 |
| i54g1qbd | Wazuh_investigation / help me investigate the security alert timeline | 100 (207 convs) | done | 2026-09-05 11:19 |
| hc2y5jfl | Wazuh_investigation / Investigate and Triage Wazuh Security Alerts | 25 (60 convs) | done | 2026-09-05 11:11 |
| 9mw2b0dl | Env Report / Help me to track the ip of google | 20 (27 convs) | done | 2026-09-05 04:28 |
| 2aovdmmh | Env Report / Help me to track the ip of google | 20 (24 convs) | running | 2026-09-05 04:05 |
| otw9jo7r | Env Report / Help me to track the ip of google | 20 (38 convs) | done | 2026-09-04 17:42 |
| amfuo747 | Env Report / Help me to track the ip of google | 20 (30 convs) | done | 2026-09-04 06:01 |