Running Exercises

The speaker presents SkillAegis, a tool built at CIRCL for designing and running cyber exercises on MISP, the open-source threat intelligence platform. It has two parts: a scenario editor where organisers define metadata, required player levels, injects, dependencies between tasks and evaluation strategies, and a live dashboard that shows participants' progress in real time and lets the organiser validate injects during a session.

Under the hood, the tool subscribes to MISP's ZeroMQ feed, which publishes events about activity on the platform, then queries the MISP API to see what players actually did. The demo walked through a malware-themed scenario where participants add phishing-related indicators to MISP. The recent release adds Docker-based startup, new scenarios and Suricata support: player-created data is exported, run through Suricata in simulated IPS mode, and the tool checks whether the player wrote a rule that would block the malicious traffic.

The talk closed with plans for more scenarios and a large-scale test, as the tool has so far run with about 80 players at once and the team hopes to reach around 200. Other tools can be integrated for training purposes. For practitioners, the takeaway is that MISP event streams can drive automated exercise scoring and that detection rules can be checked end to end in a training setting.