Skip to main content
Back to challenges
Challenge

OT Cybersecurity Cyber Incident Response Agent with Google ADK

Operational technology cyber attacks can corrupt PLC firmware or force unexpected safety system shutdowns. Build an autonomous OT incident response agent using Google ADK that ingests network syslog anomalies and automatically initiates safe isolation playbooks. Achieve a 100% containment score without triggering unintended safety shutdowns on clean lines.

EngineeringHosted by Vera
Sign in free to start
Challenge brief

What you are building

The core problem, expected build, and operating context for this challenge.

Build an OT security incident response agent using Google ADK abstractions to evaluate network syslogs and trigger containment playbooks.

Delivery guide

How work is evaluated

Evaluation

Evaluates incident containment speed and safety preservation during simulated cyber attacks.

Datasets

Challenge datasets

Public datasets, plus the private datasets you have access to.

Evaluation rubric

How submissions are scored

These dimensions define what the evaluator checks and which criteria separate a passable run from a strong one.

Dimensions
2 scoring checks
Binary
2 pass or fail dimensions
Ordinal
0 scaled dimensions
Dimension 1

safety_preservation

Ensure PLC safety system remained online during containment

Binary check

This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.

Dimension 2

containment_success_rate

Proportion of cyber attack scenarios successfully isolated • target: 1 • range: 0-1

Binary check

This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.

Learning goals

What you should walk away with

  • Configure Google ADK agents for continuous syslog stream evaluation

  • Design tool routines for executing firewall port isolation and PLC read-only locks

  • Validate zero unhandled false alarm isolations across 50 simulated baseline test scenarios

Resources and assets

Reference links and supporting material

Dataset notes

Factory network syslog logs recorded during simulated OT ransomware and unauthorized write injection attacks.

Challenge setup

Evaluates incident containment speed and safety preservation during simulated cyber attacks.

Challenge input

JSON syslog record indicating unauthorized PLC command burst

Google ADK

Offers structured tool execution loops for complex security playbooks.

Evaluated output

JSON incident response log showing isolated IP and safety status

Evaluation checks
  • Ensure PLC safety system remained online during containment
  • Proportion of cyber attack scenarios successfully isolated • target: 1 • range: 0-1
Configured evaluation evidence
  • Benchmark: OT Incident Response Suite (OT-IR-2025)
  • Containment Success Rate target: 100%
  • 1 public reference case
Configured runtime
  • Python execution harness
  • Python sandbox (unavailable on Versalist)

Summary shows the first task, up to three tools, and up to three evidence items. Open the technical recipe to view all configured items.

View technical recipe

Configured tools

Action Space
  • Google · Required
  • Google ADK · Optional
  • Google Jules · Optional
Orchestration
  • Google Jules · Optional

Evaluation contract

  • safety_preservation · Weight 1
  • containment_success_rate · Weight 1

Metrics

  • containment_success_rate · Target 1

Benchmarks

  • OT Incident Response Suite (OT-IR-2025)
  • security

Reference cases

  • 1 public reference case

Workflow tasks

  1. Task 1

    Input: JSON syslog record indicating unauthorized PLC command burst

    Output: JSON incident response log showing isolated IP and safety status

    Execution harness: Python

Evaluation tools

  • Google ADK · Agent Framework

Recipe freeze marker

No recipe freeze time is recorded.

Frequently Asked Questions about OT Cybersecurity Cyber Incident Response Agent with Google ADK