Defense teams from different countries will take part in the new format of Standoff Cyberbattle during the St. Petersburg Economic Forum

# Getting started
1.	If you don't have an account yet, [register on the Standoff 365 Platform](https://auth.standoff365.com/en-US/account/registration/).
2.	Read the [step-by-step instructions](https://help.standoff365.com/en-US/8833436683/portal) on how to set up a connection to Standoff International cyber exercise at SPIEF 2025.
3.	Go to Workspace → [Access and resources](https://cyberbattle.standoff365.com/en-US/battle/40?tab=accessAndResources), and download a VPN config file.
❗️Each polygon has its own unique VPN configuration. For correct operation, it is necessary to download a separate configuration file for each polygon through this access page. If you try to use the configuration file of another polygon, the system will deny access.


# Getting support
If you encounter technical difficulties or have any questions about the Standoff International cyber exercise at SPIEF 2025, write to our [Telegram bot](https://t.me/stf_def_support_bot)

# Completing tasks
You can find answers to all tasks in Positive Technologies security tools, which store logs and artifacts from the Standoff International cyber exercise at SPIEF 2025.
If you don't have any experience with Positive Technologies products, read the following materials:
*	 [MaxPatrol SIEM Quick Start Guide](https://storage.ptsecurity.com/d/7629f49778f14d969b18/files/?p=%2FMP-SIEM.pdf)
*	 [PT NAD Quick Start Guide](https://storage.ptsecurity.com/d/7629f49778f14d969b18/files/?p=%2FPT-NAD.pdf)
*   [PT ISIM Quick Start Guide](https://storage.ptsecurity.com/d/7629f49778f14d969b18/files/?p=%2FPT_ISIM.pdf/)
*   [PT Sandbox Quick Start Guide](https://storage.ptsecurity.com/d/7629f49778f14d969b18/files/?p=%2FPT_SandBox.pdf/)
*   [Official Positive Technologies documents](https://help.ptsecurity.com/en-US/projects)

# How are the tasks performed?
The answers to all tasks can be found in Positive Technologies SecTools, where logs and artefacts.

Note the specifics of connection and data display:
* Connection to MaxPatrol SIEM, PT NAD, PT Sandbox, PT ISIM is via **LDAP** (select the LDAP tab in the authorization window).
* PT Application Firewall  - authorization via the credentials listed below under Access and Resources - Useful Information.

Important: The timing of events depends on your time zone. For example:
- An event is logged in SIEM at 10:00 UTC+0.
- For a user from Vladivostok (UTC+10), it will show up as 18:00. 
In NAD, the time zone time is specified in the NAD account settings, Interface Setup section.
 
Don't forget to switch on VPN to work with the protection system.

cyber_battle

International cyber exercise at SPIEF 2025

N@mele$$

czon3

Heroes Cyber Security

NITDA CERRT

SAS.PDV

WeDefend

ayoub

NCSCJO

Cyber1000

OceanVsSpace

Secops Garage

S-Bastion Lab

Tube produces, refines, stores, and sells oil and gas. Its assets include an oil refinery, a natural gas processing plant, pipelines with pumping stations, a trunk gas pipeline, tankage facilities, an LNG storage tank, and oil-product loading stations for rail and sea transportation. 
 
Over the past year, State F has made significant strides in the gas industry: Tube has set up new drilling facilities and commissioned a natural gas processing plant, which is now actively recruiting staff. The company uses a gas carrier to transport its products by sea. Tube also uses a custody transfer metering skid to measure the volume and quality of products delivered from suppliers to consumers.
 
Cyberattacks on the oil and gas industry can affect other sectors in State F beyond the target companies. For instance, malicious interference could shut down the tire factory, while disruptions in the operation of an oil pipeline, fractionating column, electric dehydrator, or hydrocracking reactor could cause a fuel crisis in State F. Hackers could also disable the air cooling unit at the liquefied natural gas facility or the absorption column at the gas processing plant, resulting in long periods of downtime and significant financial losses.
 
Tube is featured in the "Oil" and "Gas" 3D models.

Oil and gas

Airoverflow

CyberTeam

beCloud

r3kapig

S.H.I.E.L.D

Pasukan Biru

R-Wang

UZCERT Blue Team

GOCYBEX

EGCERT

tunCERT

BruCERT

Heavy Logistics manages transport infrastructure and operates the traffic light system in State F. The company is also in charge of airport customs, a temporary storage warehouse, an airport express train station, and an automated parking facility for airport visitors and passengers.

State F will face catastrophic consequences if hackers break into Heavy Logistics systems and seize control. For example, they could cause a passenger information system failure, disrupt traffic, and contribute to flight delays or runway overruns.
 
Heavy Logistics is featured in the "Transport" 3D model.

International cyber exercise at SPIEF 2025

Logistics

Defender metrics

Results