OT Cybersecurity Cyber Incident Response Agent with Google ADK
Operational technology cyber attacks can corrupt PLC firmware or force unexpected safety system shutdowns. Build an autonomous OT incident response agent using Google ADK that ingests network syslog anomalies and automatically initiates safe isolation playbooks. Achieve a 100% containment score without triggering unintended safety shutdowns on clean lines.
What you are building
The core problem, expected build, and operating context for this challenge.
Build an OT security incident response agent using Google ADK abstractions to evaluate network syslogs and trigger containment playbooks.
How work is evaluated
Evaluates incident containment speed and safety preservation during simulated cyber attacks.
Shared data for this challenge
Review public datasets and any private uploads tied to your build.
How submissions are scored
These dimensions define what the evaluator checks and which criteria separate a passable run from a strong one.
safety_preservation
Ensure PLC safety system remained online during containment
This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.
containment_success_rate
Proportion of cyber attack scenarios successfully isolated • target: 1 • range: 0-1
This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.
What you should walk away with
Configure Google ADK agents for continuous syslog stream evaluation
Design tool routines for executing firewall port isolation and PLC read-only locks
Validate zero unhandled false alarm isolations across 50 simulated baseline test scenarios
Reference links and supporting material
Factory network syslog logs recorded during simulated OT ransomware and unauthorized write injection attacks.
How this agent runs
Evaluates incident containment speed and safety preservation during simulated cyber attacks.
Challenge input
JSON syslog record indicating unauthorized PLC command burst
Google ADK
Offers structured tool execution loops for complex security playbooks.
Evaluated output
JSON incident response log showing isolated IP and safety status
- Ensure PLC safety system remained online during containment
- Proportion of cyber attack scenarios successfully isolated • target: 1 • range: 0-1
- Benchmark: OT Incident Response Suite (OT-IR-2025)
- Containment Success Rate target: 100%
- 1 public reference case
- Python execution harness
- Python sandbox
View technical recipe
Configured tools
- Google · Required
- Google ADK · Optional
- Google Jules · Optional
- Google Jules · Optional
Evaluation contract
- safety_preservation · Weight 1
- containment_success_rate · Weight 1
Recipe state
This is a preview. The configuration can change before the evaluation recipe is locked.