Objective

As a member of SAVE, you have been assigned to investigate a sudden wave of coordinated attacks striking the Tricorsa enterprise. Malicious users are moving across the environment, triggering suspicious activity on multiple endpoints at once and mimicking patterns linked to a recent Unit 42 case. Your mission is to uncover their actions, identify every stage of the intrusion, and put an end to the ongoing threats before the attackers gain further ground.

Who should play

This experience is ideal for defenders, incident responders, SOC analysts, and security engineers who want hands-on practice with modern detection and response workflows. Participants who enjoy analyzing attacker movement, validating suspicious behavior, and coordinating defensive actions across multiple tools will find this scenario rewarding.

Why it matters

Ransomware groups often launch simultaneous attack chains to overwhelm defenders, especially in environments with distributed users and complex infrastructure. Understanding how to investigate identity misuse, respond to AI‑driven prompts, and track web server compromises is essential for real-world defense. Triple Threat reinforces rapid triage, coordinated response, and confident remediation using Palo Alto's integrated security platforms.

Tools

Participants will use the Palo Alto Networks NGFW for inspection and enforcement, XSIAM for incident detection and investigation, and PrismaAIRS for extended response actions. These tools work together to help teams uncover attacker activity, validate findings, and remediate threats across Tricorsa's environment.

Palo Alto Networks Triple Threat