R-Vision SIEM served as the primary platform for monitoring, correlation, and incident investigation during the Standoff 17 cyber exercise, where the akPots blue team defended the Telecom sector under realistic high-pressure conditions.
Most participants encountered the system for the first time during the event. The exercise simulated nine critical events out of 37 architected scenarios while more than ten red-team groups operated simultaneously across the infrastructure. Unlike typical SOC operations that involve large volumes of failed scans and false positives, the competition produced a dense stream of successful exploits and high-severity alerts.
The team highlighted several operational differences from routine work. In everyday environments, targeted attacks unfold over extended periods and defenders can consult system owners. At Standoff, attribution proved difficult because multiple groups attacked concurrently, and no clarification from administrators was available. Initial access vectors were especially challenging to isolate amid heavy scanning noise.
Organization relied on three key practices. A shared chat contained dedicated threads for each critical event. A living document captured IOCs, artifacts, and evidence in chronological order, allowing any team member to regain context quickly. A designated captain distributed tasks and handled organizer communications.
Alongside R-Vision SIEM, the defenders used PT Application Firewall for request and response inspection, PT NAD for traffic analysis, PT Sandbox for malware evaluation, and PT Container Security for eBPF-based visibility inside Kubernetes clusters. The Xello deception service was also deployed. Interfaces proved intuitive, enabling the team to become comfortable within three hours, although complex queries still required occasional reference to documentation.
Most valuable SIEM capabilities included raw search with wildcards, adjustable display fields, event grouping, and exclusion of known benign activity. Pre-built dashboards helped surface attacker intent before critical events were achieved. The team noted that the system handled high data volumes stably and offered clear query syntax.
Requested improvements included one-click navigation from dashboard widgets to underlying raw events, ready-made detection scenarios based on vendor expertise, and nested grouping by host and event type. Overall, the exercise provided intensive hands-on experience with new tools and reinforced the value of structured team coordination under stress.
