Assessment of Red and Blue Team Training in the Cyber Range Tectonic using Process Mining

Abstract

Cyber ranges are specialized computer systems designed to simulate realistic cybersecurity scenarios for training purposes. An in-depth evaluation process is essential for determining whether users have met their training objectives. This article examines the implementation of Tectonic, an academic cyber range, along with a thorough assessment methodology for both offensive and defensive scenarios. This approach employs process mining to analyze training activities from various perspectives. The methodology has been applied to training sessions conducted within Tectonic.