Northstar Community Network · Response desk · 08:42–17:09 UTC · Five standalone incident drills
You are on duty when familiar tools start carrying unfamiliar requests. Protect the people, follow the evidence and make the next shift stronger.
Five free incidents. One essential skill: decide when a familiar channel no longer deserves your trust.
Join the fictional Northstar Community Network for five standalone incidents inspired by documented 2025–2026 events: an impostor helpdesk, a terminal-verification trap, an unintended cloud authorisation, a tampered build tool and a silent support connector. Inspect synthetic evidence, choose bounded responses and leave an honest handoff. Three levels build from first response to release and incident coordination. Every mission is free and open in any order; no subscription, prerequisites, coding tools or external accounts are needed. Guest practice is temporary; sign in before starting to save advancement. Estimated total: 88 minutes, with no countdown. This is guided practice, not a professional certification.
A receptionist is sharing her screen with someone called IT Recovery. The visitor desk opens in eighteen minutes. Your job is to interrupt a possible intrusion without losing the evidence or blaming the person who asked for help. All tools and records you need are in the dossier.
The workshop registration page says it cannot verify a visitor. A colleague has copied its repair instructions and is asking whether to paste them into a terminal. Get the session back under control, reconstruct what actually ran and keep the check-in desk moving.
A caller said passkey maintenance would lock a coordinator out before a funding deadline. She followed a sign-in flow on her phone. Now there are cloud downloads she cannot explain. Trace the session, contain the identity and prepare an honest impact statement.
Northstar's access portal is ready to deploy. A maintainer advisory says a security scanner was tampered with, and your green build used its familiar version tag. Find which jobs actually ran the suspect code, protect exposed secrets and give the release manager a defensible decision.
A third-party support connector has made an unusual export. Your helpdesk dashboard still looks normal. Decide which access to revoke, whether the export completed and how to protect secrets embedded in old tickets, then brief the next shift without inventing certainty.