Operation Glasshouse · Counterintelligence
Someone knew about the launch before the launch team did.
A fictional aerospace company has had confidential milestones appear in a competitor briefing. The obvious suspect may be a false trail. The full mission trains SQL, evidence reconciliation, hypothesis testing, and judgment under pressure.
- Stage
- Investigate
- Role
- Intelligence Analyst
- Access
- Showcase
Three confidential milestones leaked within hours of internal approval. Security suspects an insider. Legal suspects a vendor. Raw telemetry suggests the visible account may not identify the human actor.
Training objective
Reconstruct the access path, test competing explanations, and decide what can be contained now without making an attribution the evidence cannot support.
peopleaccess_eventsdevice_loginsfile_eventsvendor_contactsbadge_eventsInvestigation pathSample directive 3 of 5
GROUP BY · repeated-pattern analysis
Test whether the anomaly is stable
Compare suspicious sessions by device, network, management state, and authentication method. The paid/private runtime verifies the query you write and changes the mission as you progress.
Showcase only
SQL workspaceExecutable workspace available in training mode
Sample task
Determine whether the same anomalous access path appears across multiple leak windows.
Full execution requires training access
| device_id | network | managed | auth_method | sessions |
|---|---|---|---|---|
| managed-device | corp-network | yes | webauthn | 1 |
| unknown-device | external-asn | no | sso-session | 3 |
Live sitrepSample of the adaptive pressure layer
Badge contradiction
The visible account appears in a late-night export after its owner had already left the facility.
Does that clear the person, implicate remote access, or expose a logging gap?Identity telemetry
Raw authentication telemetry identifies the same unmanaged access path across multiple suspicious windows.
The full mission now asks you to reconcile this against your earlier hypothesis.Competing hypothesesSample state
Malicious insider
Status Weakening
Account activity looks suspicious, but physical and device evidence do not align cleanly.
Stolen credentials
Status Strengthening
Repeated unmanaged access creates a stronger explanation, but human attribution remains provisional.
Vendor disclosure
Status Open
A real relationship creates a plausible false lead that still must be tested.
Instrumentation error
Status Weakening
Raw events preserve the anomaly even when dashboard identity logic is removed.
Mission worldsTraining scenarios rotate across domains
Operation Glasshouse
Counterintelligence, identity attribution, joins, timelines, and conflicting evidence.
Night Train
Trace a courier network through transit, lockers, manifests, and route anomalies.
Orbital Failure
Conflicting telemetry, a shrinking repair window, and uncertainty about the failing system.
Private beta. Full mission execution, datasets, hints, adaptive sitreps, scoring, saved progress, and the complete training runtime require authenticated access.
Payment access is not active yet. Owner login is available through the secure training gate.