Build a blue-team CTF your analysts can't Google the answers to
A capture-the-flag is one of the better ways to sharpen a blue team: hands-on, competitive, and it rewards digging through evidence. It has one failure mode that shows up the moment you run it twice.
The first team to solve a flag can hand the answer to everyone else, and a CTF you reuse next quarter is already burned. The fix isn't more secrecy. It's making the flags impossible to share.
Every shared CTF leaks
If all your players work the same box with the same flags, the flags are a shared secret, and shared secrets travel. It happens inside a single event when people compare notes across tables, and it happens between events when last year's write-up is sitting in a chat channel. Either way you stop measuring who can do the work and start measuring who has the answer sheet.
Different flags for every player
Red Herrings seeds every case per person. The evidence is built from a seed, so each analyst's version has its own hostnames, user accounts, IP addresses, timestamps and hashes, and therefore its own flags. There's no master answer to pass around: the only path to one analyst's flag is through that analyst's evidence. You can hand the same case to a room of fifty and get fifty different answer keys, each verified against the exact files that player received.
A flag that's the same for everyone is a secret waiting to leak. A flag computed from each player's own evidence is one they have to earn.
Run it as a timed CTF or a graded drill
Any case can run as a capture-the-flag, with its own evidence and flag set for each team and an import file for CTFd, where players submit flags as they find them. Or run it as a graded exercise through the student portal with a server-side timer that starts when the player opens their link and locks their submission at the end. The answer key stays on your machine and never reaches the browser, so the game is honest even when nobody is watching the room.
Score the room, and see the collusion
Grading is automatic and runs locally, with a per-question report that flags which submissions look most alike. In a CTF where everyone has different evidence, matching answers are a signal, not a coincidence, so if two players did work together you'll see it in the report rather than wonder about it.
It's real evidence, not a trivia round
The flags come out of real artifacts: EDR detection feeds, SIEM exports, event logs, registry hives, packet captures, memory and disk images, opened in the tools your analysts already use. Players aren't guessing at a quiz; they're doing the job, which is the whole point of running a CTF for a blue team in the first place.
The First Look cases are free, and a 30-day trial adds a set of sample cases. Generate a per-player case, run it as a CTF or a timed drill, and grade the room from one sheet.
