CYBRARY Replay Theater
Four recorded runs, from one analyst working a single endpoint up to two teams racing the same estate. Scrub any of them: every screen, alert and point you see was produced by the same engines that score a live run.
Solo lab — token theft on a single endpoint
15:20 · 17 logged actions · 2 alertsChapter-by-chapter walkthrough with the pivotal moves called out and coached.
Triage — what to notice: Watch what they looked at before touching anything — the order of the first three reads usually predicts the whole run.
Participant screens
2 seats · split screen- — idle desktop, nothing done yet —
Screens are re-rendered from each seat's recorded window track at the cursor — the real layout they had open, reconstructed from state rather than captured as video. Runs recorded before the screen track fall back to a summary of the action log.
- Before the first logged action.
Score accrual
Points as they were earned, sampled every 30 seconds of run time.
Standing at 00:00
- 1vireo1 actsfp 00
Alerts fired (0/2)
Nothing has tripped a correlation rule yet.
Automation queue
No playbook has been bound yet — automation reacts to the alerts above.
Who was in the room
vireo90 pts
Analyst, tier 2
11 actions · 5 decisive · noise 0
unattributed0 pts
Simulated adversary
6 actions · 0 decisive · noise 52
Zoom into any seat in the replay above to watch that person's console on its own, or leave the grid up to see who was reading while someone else pulled the trigger.
How the run scored
739 / 940
Elite96% outcome · rs-2- Scoping100%
3/3 found
- Containment100%
3/3 found
- Chain reconstruction86%
3/4 found
- Gap handling100%
1/1 found
- Scope and containment were complete — every stolen session was revoked before the case closed.
- The narrative missed collection: the analyst never stated what the actor was reading once inside.
- The proxy blind spot was named, which is why the egress claim held up.
Simulated environment. No real systems, customers or people appear in these recordings. Browse the activity library →