Cyber RangeAI SecuritySecurity
Cyber Range

Palo Alto Networks CTF: Triple Threat

Event Overview

Step into the role of a SAVE defender and face a coordinated, multi-front attack in a live Cyber Range environment. Your team of 3 to 4 will use Palo Alto Networks Cortex XSIAM, Prisma AIRS, and Next-Generation Firewall to investigate an AI prompt injection attack, a phishing compromise, and a web server breach, then stop the attacker and eradicate the threat. Work together, race the clock, and earn your place on the scoreboard. Tools & Resources: 🔶 Palo Alto Networks Cortex XSIAM 🔶 Palo Alto Networks Prisma AIRS 🔶 Palo Alto Networks Next-Generation Firewall (NGFW)

What to expect

Intelligence from Unit 42 indicates a coordinated actor has launched three simultaneous attacks against the organization: an AI prompt injection attempt, a phishing campaign that slipped past defenses, and a compromise of the company's web server. As members of the SAVE team, you are tasked with investigating each thread, tracing them back to a common attacker, and stopping further malicious activity — modeled on real Unit 42 threat intelligence — before it escalates.
  • Explore a custom scenario built around Palo Alto Networks: this scenario immerses your team inside a live, three-front attack, giving you hands-on experience investigating and responding across AI, endpoint, and network surfaces.
  • Defend across the full stack with Prisma AIRS, Cortex XSIAM, and NGFW: Prisma AIRS secures the AI application layer, NGFW provides network visibility and control, and XSIAM centralizes logs from every component so you can trace, investigate, and respond from a single pane of glass.
  • Test your skills: you'll face AI prompt injection, phishing, and web-compromise techniques — each escalating toward malware modeled on real Unit 42 threat intelligence — that will challenge your ability to detect, correlate, and eradicate a coordinated attack.

Goals and Objectives

Event Objectives 🔶 Detect, investigate, and respond to a coordinated attack across AI, phishing, and network attack vectors. 🔶 Gain hands-on experience with Prisma AIRS, Cortex XSIAM, and Next-Generation Firewall under real gameplay conditions. 🔶 Build teamwork and incident response skills by tracing attacker activity, stopping further actions, and identifying all malicious activity.

Who should attend?

SOC analysts and incident responders, threat hunters, SIEM and XDR engineers, network security engineers, AI/ML practitioners, security architects, and CISOs and security leaders evaluating Palo Alto Networks AI, network, and SOC platforms. The scenario is built around a coordinated attack that hits an AI application, user endpoints, and a web server at once, and the skills apply to every industry. If your organization is moving AI into production, this is a fast way to show your team is ready to defend it, and to learn how Cortex XSIAM, Prisma AIRS, and Next-Generation Firewall work together to detect, investigate, and stop an attack across the full environment.

Related content

Palo Alto Networks Next-Generation Firewall (NGFW)

Learn the basics about network security and how next-generation firewalls (NGFW) fits in and establish a baseline knowledge to help aid you through the Next-Generation Firewall learning paths. Throughout this learning path you will learn network security, tools and techniques used to help secure your network, and how the NGFW fits into your security requirements. You will have the opportunity to explore these concepts that will help you walk the NGFW learning path with ease and comfort to aid you on your successful journey of learning NGFW! Now let's get started!
Learning Path
•Fundamentals
ATC+

Palo Alto Cortex XDR

Learn about Palo Alto Cortex XDR, Palo Alto's extended detection and response platform that natively integrates network, endpoint, cloud, and third-party data to stop modern attacks. In this Learning Path, you will explore the architecture on which Cortex XDR runs, as well as look into the deployment of Cortex XDR agents and the creation of profiles and policies. You will also learn about the detection and response capabilities that are provided by Cortex XDR.
Learning Path
•Fundamentals

Cyber Range - Initiation

Initiation is a Capture the Flag (CTF) lab meant to introduce you to the WWT Cyber Range platform and serve as a tutorial for future events. You will be introduced to the features and functionality as well as provided tips for success during future WWT Cyber Range CTFs. This lab will also allow you to test your access using the same platform we use for our live CTF events so you can make sure you will be ready on game day.
Advanced Configuration Lab
•Fundamentals
1331 launches

Palo Alto Networks Threat Zero Learning Path

Learn the fundamentals of securing your network, endpoints, and AI workloads, and see how Palo Alto Networks technologies work together to protect each layer. Throughout this learning path you will explore Next-Generation Firewall (NGFW) concepts, Cortex XDR endpoint detection and response, and Prisma AIRS runtime protection for AI applications. You will gain the baseline knowledge to confidently build consistent security policy and visibility across your environment. Now let's get started!
Learning Path
•Fundamentals