Standoff 17

R-Vision SIEM Demonstrates Resilience During Intense Standoff 17 Cyber Defense Exercise

A mixed team from akPots defended the Telecom sector at Standoff 17 using R-Vision SIEM as the central correlation platform while facing more than ten simultaneous red-team groups. The exercise featured nine realized critical events out of 37 planned scenarios, including satellite tracking disruption, IPTV broadcast manipulation, and unlimited eSIM issuance. Team members had to master the SIEM in real time rather than through pre-loaded logs, relying on raw search, custom dashboards, and grouping features to cut through massive alert volumes. Additional tools such as PT Application Firewall, PT NAD, PT Sandbox, and PT Container Security provided visibility into network traffic, file behavior, and Kubernetes environments. The team organized work through dedicated chat threads, a shared living document for IOCs, and a captain role to balance workload across distributed participants. Feedback highlighted the need for one-click widget-to-raw-event navigation, vendor-supplied detection scenarios, and nested grouping to improve future investigations.

Grep_Tribe Blue Team Shares SOC Defense Lessons from Standoff 17 Cyber Battle

The Grep_Tribe team participated in Standoff 17 for the third time, defending the RetailSTF Group infrastructure in a simulated State F environment against continuous red team attacks. They handled 37 confirmed incidents, 22 detected incidents, five investigated critical events, and maintained 88 percent average infrastructure availability. The team used familiar Positive Technologies tools alongside the new R-Vision SOAR platform to automate routine responses such as IP blocking and file sandboxing. Work was organized through a tribal system with role-based preparation and dynamic small-group investigations for complex attack chains. Participants highlighted how the event tested prioritization, Threat Intelligence attribution, and automation under high-intensity conditions unlike daily SOC operations. The experience reinforced plans to expand SOAR playbooks for repetitive tasks in their real internal SOC environment.

R-Vision SIEM Debuts at Standoff 17 Cyber Battle and Processes 8.8 Million Correlation Events

R-Vision presented its SIEM solution for the first time at the Standoff 17 cyber exercise, where the akPots team used it to monitor a telecom operator infrastructure and investigate incidents. The product was deployed in two weeks, with 80 percent of required event sources already supported out of the box. During four days of continuous attacks the system triggered 46 correlation rules, generated more than 8.8 million correlation events and 40 thousand alerts, while analysts created 13 custom widgets and executed over 9,000 search queries. Resource consumption remained low, with the collector averaging 0.7 CPU and 1.9 GB RAM even under peak load. Participants rated the solution 4 or 5 out of 5 and highlighted raw-text search, the RQL query language and event grouping as the most useful features. The exercise also identified areas for interface and alert-description improvements.