Catalina Cyber Response Challenge

What is this?

A capture-the-flag competition, but not the kind where you break into things. You play the defender. We build a fake company, we attack it on purpose, and we record everything its computers saw while it happened. On event day you get those records and work out the story: who got in, how, what they touched, and what they took.

🔍

You are the analyst

This is the job real security teams do. Sift the evidence, follow the trail, and prove what happened. No prior CTF experience needed.

👥

Teams of five

Come with a team or get placed on one. Everyone contributes, and the questions are built so newcomers can score early and often.

📜

Points and a write-up

Flags earn points during the event. Afterward each team submits a short incident report using the SANS PICERL model. Both decide the winners.

How the day runs

Doors at 7:30am, competition from 8:00am to 12:00pm. Exact block times get confirmed closer to the date.

7:30AM · DOORS

Check in, grab your team credentials, log into the platform, and pick up your cheat sheet. Coffee happens here.
8:00AM · WARM UP

We walk through one question together, start to finish, on the big screen. Nobody starts from a blank page.
THE INVESTIGATION

The main event. Questions run from guided to wide open, so there is something to work on whatever your level.
12:00PM · WRAP UP

Scores, a walkthrough of what actually happened, and prizes.
WITHIN 48 HOURS

Teams submit a written incident report. Judges from local industry and faculty review them alongside the scores.

How to get ready

Short answer: you do not need to do anything. Longer answer, if you want an edge:

Bring a laptop

Any laptop with a web browser works. Windows, Mac, Linux, Chromebook. Nothing to install, and no VPN client to set up. You will get a link and a login.

Skim the basics

If you know what a Windows event log is and roughly what the stages of an attack look like, you are in good shape. If not, that is what the warm up round is for.

Practice ahead of time

We will post a small practice case and a walkthrough in the Discord a couple of weeks before the event. Optional, but the people who do it tend to carry their teams.

Find a team

Come with up to five people, or show up alone and we will place you. Team matching happens in the Discord.

Come say hello

The Discord is where team matching, practice material, and every announcement happens. Scan it or click it.

QR code linking to the Catalina Cyber Response Challenge Discord server

discord.gg/XrESn2t8rk

Already registered?

Great. Join the Discord anyway. That is where you will find teammates, the optional practice case, and the answers to questions you have not thought of yet.

Want to help build it?

We need people to help build the environment, write challenge questions, and create the fake company. It is genuinely good resume material, and you get first shot at running the attack side next year.

Join the Discord

Questions

If yours is not here, ask in the Discord.

Do I need experience to compete?

No. The challenges are tiered. The early ones tell you exactly where to look, and they get harder from there. Plenty of teams will be first timers.

Who can enter?

Anyone. The event is built for students first, and the difficulty is tuned for people early in their cyber education. Professionals, educators, and industry partners are genuinely welcome too, and plenty will be in the room.

Do I need my own team?

No. Bring up to four teammates, or come solo and we will put you on a team.

What do I need to bring?

A laptop and a charger. Everything runs in a web browser, so there is nothing to install beforehand.

Is it really free?

Yes, and so is parking. Registration is required so we know how many seats and how much food to plan for.

Where exactly is it?

Pima Community College East Campus, 8181 East Irvington Road, Tucson, AZ 85730. Doors at 7:30am.

Will I actually hack anything?

Not this year. You are on the defending side, investigating an attack we already ran. A live attack track is something we are looking at for future events.

Can I help build it?

Yes, and we would love the help. Building the environment is genuinely good resume material. Builders cannot compete in the event they helped create, but they get first shot at running the attack side next time. Come say hello in the Discord.