Build clean rows
Use movement, rotation, soft drop and hard drop to organise the workload. Clearing several rows at once earns more points.
PROTOCOL 017 // ALERT QUEUE CONTROL
CYBER STACK
Defend the SOC. Contain the threats. Don't let the alerts overwhelm you.
HOW TO PLAY CYBER STACK
Move and rotate each falling signal to complete horizontal rows. Cleared rows leave the SOC queue, increase your score and accelerate the next level. The shift ends when new work can no longer enter the grid.
Contain threat blocks
From level three, infected blocks can enter the queue. If left active for several locks, one may spread to an adjacent block.
Answer without losing flow
Short analyst checks appear after selected clears. A correct answer awards Firewall, Quarantine or Threat Intel support.
Control the pressure
Levels continue indefinitely. Falling speed and threat pressure increase gradually while retaining a playable minimum interval.
WHAT HAPPENS INSIDE A SECURITY OPERATIONS CENTER?
A Security Operations Center brings people, processes and security technology together to monitor systems, investigate suspicious activity and coordinate incident response. Cyber Stack uses an alert queue as its central metaphor: signals arrive continuously, prioritisation matters and unresolved threats can create more work.
What does a SOC analyst do?
A SOC analyst monitors security alerts, checks the evidence behind them, decides what is urgent and investigates activity across identities, endpoints, networks and cloud services. Analysts document their reasoning, escalate serious cases and may take approved containment actions. Entry-level work often focuses on alert triage, while experienced analysts handle deeper investigation, detection engineering and threat hunting.
What is SOC alert triage?
SOC alert triage is the first structured review of a security signal. The analyst validates the alert, identifies affected assets and users, checks related activity, estimates severity and chooses the next action. A useful queue is prioritised by risk and context, not simply processed in the order alerts arrived.
What is the difference between an event, alert and incident?
An event is an observable occurrence in a system or network. An alert is a signal generated when activity matches a rule, pattern or analytic. An incident is an occurrence that requires coordinated response because it threatens confidentiality, integrity, availability or organisational operations. Not every event becomes an alert, and not every alert becomes an incident.
How does threat hunting support a SOC?
Threat hunting proactively searches for attacker behaviour that existing alerts may have missed. A hunter starts with a hypothesis or intelligence lead, examines telemetry, tests explanations and records useful findings. Successful hunts can reveal incidents and improve future detection logic.
THE REAL INCIDENT QUEUE
DETECT. ANALYSE. CONTAIN. RECOVER.
- 01Collect useful evidenceLogs from identity systems, endpoints, networks, applications and cloud services provide context for detection and investigation.
- 02Validate and prioritiseAnalysts separate false positives and low-risk activity from signals that need urgent investigation.
- 03Scope the incidentResponders identify affected accounts, systems, data, attacker behaviour and the likely path through the environment.
- 04Contain safelyActions can include isolating a device, disabling an account, blocking infrastructure or segmenting network access.
- 05Recover and improveTeams restore operations, monitor for recurrence and turn lessons into stronger controls and detections.
TERMS USED IN THE GAME
Malware
Software designed to steal, spy, disrupt or gain unauthorised access.
Phishing
Deceptive communication that manipulates people into revealing information or taking unsafe action.
Credential attack
An attempt to steal, guess, reuse or abuse account authentication information.
Suspicious traffic
Network activity that differs from expected behaviour and needs context before it can be judged.
Ransomware
Malware that disrupts access to systems or data and is commonly connected with extortion.
Data exfiltration
The unauthorised transfer of data from an organisation or controlled environment.
PRIMARY GUIDANCE
LEARN FROM CURRENT INCIDENT RESPONSE SOURCES
The game simplifies security operations for play. Real incident response depends on the organisation, its systems, authority, evidence and response plan. NIST's current guidance treats incident response as part of cybersecurity risk management across preparation, detection, response and recovery.
NIST SP 800-61 REVISION 3 ↗NIST INCIDENT RESPONSE RESOURCES ↗CISA SECURITY OPERATIONS AUTOMATION ↗CYBER STACK FAQ
What is a Security Operations Center?
A Security Operations Center, commonly shortened to SOC, is a team and operational capability that monitors security signals, investigates suspicious activity and coordinates the response to cyber incidents.
What does a SOC analyst do?
A SOC analyst reviews alerts, validates evidence, prioritises risk, investigates suspicious behaviour, documents findings and escalates or contains incidents according to the organisation's procedures.
What is alert triage in cybersecurity?
Alert triage is the process of checking whether a security signal is relevant, gathering context, estimating urgency and deciding whether it should be closed, investigated or escalated.
What is threat hunting?
Threat hunting is a proactive search for attacker behaviour or compromise that automated alerts may not have identified. Hunters form a hypothesis, collect evidence and refine detections from what they learn.
Is Cyber Stack free to play?
Yes. Cyber Stack is a free online cybersecurity browser game with no account, download or login required.
Does Cyber Stack save my score?
The best score is stored locally in the current browser. It is not uploaded to an account and may disappear if browser storage is cleared.