A step-by-step guide to joining, working through, and reviewing your results in a Dynamic Threat Range exercise.
How Dynamic Threat Range works
Dynamic Threat Range(DTR) puts you inside a live environment and asks you to work through it the same way you would on the job — with real tools, your own judgment, and the evidence in front of you. Depending on the exercise, that might mean hunting an attacker through a SIEM, responding to an incident, running the attack yourself, or fixing the vulnerability that made it possible. The platform won't tell you whether your answers are correct during the session. You submit what you find, and you get your results in the debrief when the exercise ends.
Joining an exercise
Step 1: Review the exercise dashboard
Before you join, take a moment to look over the exercise dashboard. It shows you:
- A scenario overview and organizational context
- An interactive network diagram of your team's environment infrastructure and status
- Exercise guidance and tactical tips
- Your team members and who has already joined the environment
This gives you useful context before you enter the live environment.
Step 2: Join the exercise
Once your facilitator has initialized the environment, click Join Exercise. This takes you into the live participant interface where your team's tools are provisioned and ready.
Step 3: Read the mission briefing
Before you start work, read the Briefing. It sets out the background for the scenario (for example, Orchid Banking Group), what's expected of you, and your specific objectives for the session. It's worth reading carefully — it shapes how you approach the exercise.
Conducting your exercise
Step 4: Do the work
What you do here depends on your exercise specialization. Whichever it is, the platform won't confirm or deny your answers as you go — you work from the evidence you find and submit based on your own analysis, just as you would in a real engagement.
Incident Response and Threat Hunting
Open the SIEM assigned to your session — Elastic, Splunk, or Microsoft Sentinel. Your task is to investigate the attack traffic and answer the questions listed in the Left-Hand Pane.
Once you've captured sufficient evidence, the final action depends on your specialization:
- Threat Hunting: escalate based on your playbooks once you've gathered enough detection evidence.
- Incident Response: respond based on your playbooks once you've concluded the investigation.
Red Team
Work through the target machines from your Kali attack box, which is surfaced in your browser as three tabs: OpenWebUI, PentAGI, and the Kali Desktop. Switch between them freely — lean on the AI options where they carry their weight, and drop back to the manual desktop where they don't. As you gain access to each machine, recover the tokens hidden across the network and submit them to answer the questions. The questions follow the natural attack path, so what you find early often unlocks what comes later.
Developer
Work in the browser-based VS Code editor. Clone the repository, triage the issues on your ticket board, and fix the vulnerabilities in the application source. Each task completes automatically when the platform validates your fix — the flaw is closed and the feature still works. There's nothing to submit by hand; a passing fix marks the task done.
What's being measured
You won't see your score while the exercise is running, but the platform tracks your team's performance throughout. The metrics depend on the specialization.
Threat Hunting:
- Time to Detect (TTD): the time elapsed between the start of the live attack and accurate evidence of detection being submitted.
- Time to Escalate (TTE): the time elapsed between the start of the live attack and escalation of the incident. This metric requires sufficient evidence of detection to have been submitted first.
- Tasks Completed: the number of tasks with a correct final submission.
- Accuracy: the percentage of correct submissions, calculated by dividing the number of tasks with correct final submissions by the total number of tasks.
Incident Response:
- Time to Investigate (TTI): the time elapsed between the team being able to join the exercise and the conclusion of the investigation.
- Tasks Completed: the number of tasks with a correct final submission.
- Accuracy: the percentage of correct submissions, calculated by dividing the number of tasks with correct final submissions by the total number of tasks.
Red Team and Developer:
- Time to Complete: the time elapsed between the team being able to join the exercise and the completion of the work.
- Tasks Completed: the number of tasks with a correct final submission.
- Accuracy: the percentage of correct submissions, calculated by dividing the number of tasks with correct final submissions by the total number of tasks.
For AI-assisted exercises, the debrief also reports Total Token Cost, with a Token Cost Breakdown showing spend per model.
Post-exercise debrief
When the exercise ends for your team, you're automatically taken back to the exercise dashboard for the debrief.
The Debrief tab shows your team's final performance metrics based on the exercise specialization. For metric definitions, see What's being measured above.
You can also open the Range tab to see the environment and network diagram. That gives you a view of the full infrastructure you were working with during the exercise, which can help make sense of the attack path when you're reviewing what happened.