You are the SOC. Attacks swarm the floor and your detections fire on their own. The thing that kills you is noise.

One rule firing on a member of staff is a signal. Enough signals on the same person is an alert, and only alerts cost you.

WASDmove. Most rules aim where you face
1-5switch a rule off when it is behind too many alerts
Spacehold to write the report and bank your score
PpauseMmute
Touch controls appear on a phone or tablet: a thumb stick on the left, the report button on the right. Turn the phone sideways for a floor four times the size.
How a shift works
Campaigns. Each shift is one of five actors running its own playbook. You get a brief, an opening pick, and a bonus objective.
Risk-based alerting. A rule firing on a person adds risk to that person; the risk decays; only crossing the threshold raises an alert. Alerts cost budget and pile up in a queue that slows your recovery. Zero budget means you are drowning and the run is over. Losing Active Directory ends it too.
Drafts. Every 30 s pick a card: a new detection, a tuning, intel, or hardening. Some tunings buy coverage with noise. Some pairs of rules combine. Each wave introduces one idea and the banner names it.
Rotation. Hash and IP rules stop working as attackers repack, move, go fileless, tunnel their C2 and register scheduled tasks. Climb the pyramid.
Incidents. Three land during the shift. Some help. A bad rule pack doubles your noise until you switch the rule off.
The final threat. It arrives at 4:00 with a health bar and three phases, and it will try to stop one of your rules. Hit it while it is reaching and the attempt fails. Only behaviour-tier rules damage it; signatures do nothing.
Detection library
Achievements
Display and sound