SAGA.
A range with a story.
An independent engineering project for building believable attack scenarios and turning them into repeatable blue-team and incident-response exercises.
One exercise.
Connected responsibilities.
A useful exercise connects the story being tested, the environment people work in, and the evidence they use to understand it. This is the logical shape of SAGA.
Scenario intent
The story, objectives, boundaries, and evidence an exercise is designed to produce.
Exercise control
Prepare the conditions.
Validate the intended paths.
Reset for the next run.
Exercise world
Identities, applications, and user activity, connected by a believable business story.
Observation
Collect the signals.
Preserve the evidence.
Reconstruct what happened.
Debrief & learning
Compare observations with the intended outcome. Carry technical findings and analyst decisions into the next exercise.
The same story.
Different perspectives.
Each participant needs a useful view of the exercise, with the right context for their role.
For the exercise designer
Start with what people should learn. Define a believable business context, intended attack paths, expected observations, and conditions for success.
The scenario ties those choices together so the exercise has a purpose beyond reaching a vulnerable service.
For the defender
Work from observations toward an explanation. Identity, application, endpoint, and network evidence provide different parts of the same story.
The debrief connects technical findings with analyst decisions, communication, and the questions worth asking next.
For the engineer
Prepare the environment, validate the relationships that matter, and make reset part of the design. Versioned inputs and explicit checks support repeatable conditions.
The current engineering focus is a shared scenario contract spanning preparation, simulation, validation, evidence, reset, and reporting. This is an evolving project, not a claim that every integration is complete.
Practice.
Understand.
Refine.
The goal is a better explanation of what happened and a more useful next exercise.
Prepare with intent.
Agree the objectives, build the required setting, and check that the intended relationships behave as expected.
Keep both perspectives.
Connect adversary activity with what the defender can observe. Preserve evidence and the reasoning behind analyst decisions.
Carry the lesson forward.
Compare observations with the intended story, reset the environment, and use the lesson to improve the next run.
Go deeper
with context.
Start with the logical model. Detailed lab investigations are available when you want to examine a particular piece of evidence.
Understand the relationships.
A role-by-role explanation and an illustrative scenario show how intent, activity, evidence, and learning connect.
Read the logical topologyExamine a lab investigation.
A sanitized WordPress investigation traces discovery through controlled execution, verification, and cleanup. This is detailed technical evidence from an authorized lab.
Read the technical investigationMake practice
more purposeful.
Talk to me about scenario design, lab engineering, or collaboration.