Free game · no signup · about 6 minutes
Evidence Expiry Race
In an AI incident, the order you collect evidence in decides how much of it survives. Some sources keep six years; others delete themselves in a day or a month, and an incident is usually found long after it started.
Each round deals a random organisation: Enterprise or Team, CMEK or not, a cleanup period, an OTel retention, maybe an export someone forgot to download. You get a few analyst hours a day. Spend them well.
An incident involving Claude has just been found. Each evidence source has its own clock. Spend your analysts’ hours in the right order before the evidence ages out.
Difficulty
Synthetic training data: the organisation, people, IP address (RFC 5737) and configurations are invented. Retention rules follow published Anthropic documentation as of October 2026.
Three kinds of clock
Fixed and long. The Activity Feed keeps six years, so it rarely needs to be first. Its trap is the start date: it records only from first enablement, so a feed switched on last month cannot see an intrusion from last quarter.
Rolling. Claude Code local transcripts (cleanupPeriodDays, default 30, see the .claude directory), OTel in your SIEM, EDR and IdP logs each hold the last N days. Every day you wait, the oldest day of the incident falls off. When an incident started long ago, these are the urgent ones, and the shorter the retention, the faster they drain.
Countdowns. The CSV audit export looks back 180 days from when it is generated, and its link dies 24 hours later. Generate it early and download it the same day. A key with delete scope in the wrong hands is another countdown: swap to a read-only key before collecting anything else from the Compliance API.
Point-in-time files such as ~/.claude.json, .mcp.json, hooks and CLAUDE.md do not expire, but they change. A well-meaning reinstall replaces exactly the config you needed to see. Snapshot first, ask questions after.
Questions
Which Claude evidence should I collect first after an incident?
Whatever is about to disappear. A generated CSV audit export link expires after 24 hours, Claude Code local transcripts are removed after cleanupPeriodDays (30 by default), and OTel, EDR and identity logs roll off at whatever retention you set. The Activity Feed keeps six years, so it can usually wait a few hours. Lock down collection keys early if an intruder may hold one with delete scope.
Why does the CSV audit export lose evidence if I wait?
It looks back up to 180 days from the moment you generate it. Every day you delay generating it, one more day at the start of a long-running incident falls outside the window. Once generated, the download link lasts 24 hours.
How is the game scored?
Each evidence source has an investigative value. The first day of suspicious activity counts extra, because that is where initial access shows. Most of the score is how much of the at-risk evidence you rescued (what would be lost by collecting everything at the end); the rest is how much of everything still available at discovery you kept. Evidence already gone before discovery is explained but does not count against you. A look-ahead benchmark plays the same seed so you can compare your order.
Is the scenario real?
No. Dunmore Analytics, its people, the IP address (an RFC 5737 documentation range) and every configuration are synthetic training data. The retention rules follow published Anthropic documentation as summarised by Invictus Incident Response in October 2026.
Keep going
- AI Evidence Readiness Checker: see your own organisation’s windows before the race starts.
- AI Investigation Scoping Lab: decide which sources a case needs and in what order to pivot.
- Forensics Lab: classic digital-forensics investigation practice.
- Agent-IR Tabletop Lab: run the response to a hijacked AI agent.
- AI Incident Response Checklist: the template to put your acquisition order into.
Further reading: Invictus Incident Response, “Frontier Forensics: Anthropic” (v1.0, October 2026, TLP:CLEAR), whose retention-at-a-glance chart inspired this game; their cheat sheet is on GitHub. Confirm current windows in Anthropic’s documentation before relying on them.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.