Breach Response is a security-operations board mid-incident. It escalates from a red-alert breach through containment steps to a calm “all-clear”, with a live attack map, a response timeline and severity read-outs. It dramatises what an incident dashboard looks like on TV — not a real SOC.
What makes Breach Response different
Breach Response is a security-operations board mid-incident: it escalates from a red-alert intrusion through containment and isolation to a calm all-clear, with a live attack map, a response timeline and severity read-outs. Where the Decryption Lab is a slow forensic bench, this one is an urgent SOC dashboard with a real six-phase incident that plays out on screen.
What you can do with it
- A tense “we’re under attack” screen for videos, films and streams
- A fictional SOC / incident-response prop for security talks (clearly labelled as fake)
- A dramatic backdrop that resolves on a loop for ambient use
How to use Breach Response
- Press number keys 1–9 (or the action buttons) to drive the incident — INTRUSION DETECTED, CONTAINMENT INITIATED, SEGMENT ISOLATED, THREAT NEUTRALIZED, INTEGRITY RESTORED — each moves it to a specific phase.
- Or turn on Auto/presentation mode and the incident walks itself through all six phases (Detection → Confirmation → Containment → Isolation → Recovery → Restored) and loops.
- In Customize, set the incident codename and the number of affected segments.
- Press Fullscreen (or add ?present=1) for a tense “we’re under attack” backdrop that resolves on a loop.
Customize it
Set the incident codename and the number of affected segments, and tune the activity speed. Every alert, metric and map point is scripted — there is no real monitoring behind it.
Is an attack actually happening?
No. There is no monitoring, no traffic and no systems behind it. The breach, the map and the timeline are a scripted animation.
Can I trigger the escalation on cue?
Yes. Use the cinematic Actions (keys 1–9) to fire alerts, containment steps and the all-clear whenever you want them.