Place tools within 2 cell range to unlock synergy bonuses:
🔥 + 🐳 (Firewall + Docker) = Docker handles threats Firewall can't stop. Both get +25% damage.
☁️ + ⎈ (Lambda + K8s) = Elastic + self-healing. Both get +30% damage, Lambda heals PROD +2/s.
🔥 + 🕵️ Front-line + Perimeter = Firewall shields other tools. All tools get +15% range.
All 4 together = Perfect incident response. +40% damage all, heal +4/s.

LOAD THREATS — happen when systems receive more work than they can handle
📈 Traffic Spike = sudden 10× traffic in microseconds. Connections exhaust. Timeouts. Example: Someone tweets your service.
🌊 Traffic Flood = sustained high load for minutes. Exhausts both network and CPU. Example: Server reaches front page of news.
⏱ Request Timeout = requests hang, threads block. Service becomes unresponsive but still running. Example: Database query takes 30s instead of 100ms. BUG THREATS — happen when code has logical errors or resource leaks
🐛 Runtime Bug = unhandled exception in production code. Crashes one request, isolates to one pod in containers. Example: null pointer in user API.
💥 Service Crash = critical bug or OOMKilled. Whole service dies. Example: Infinite loop consuming all RAM, OS kills process.
💾 Memory Leak = process slowly consumes RAM without releasing it. Eventually OOMKilled. Example: Event listener never unregistered, grows every request. SECURITY THREATS — happen when attackers or misconfigurations expose the system
💣 DDoS Attack = attacker floods with millions of fake requests. Network layer can't tell them apart from real users. Firewall rate-limits at source.
🕵️ Intrusion = attacker scans open ports, probes for vulnerabilities. Firewall IDS/IPS (Intrusion Detection System) detects and blocks suspicious patterns.
🔓 Auth Attack = credential stuffing, brute force, or bad login tokens. Firewall can rate-limit. Docker isolates compromised auth service.

SLO (Service Level Objective) = percentage of time your service is UP and responding. 99% SLO = 7.2 hours downtime allowed per month. Each PROD breach = SLO violation. Goal: keep 100% uptime, or SLO% as high as possible.
MTTR (Mean Time To Recovery) = average time from incident start to full resolution. This game tests your MTTR. Fast response = lower MTTR = happier users.
RESILIENCE = how well your system survives failures without going down. 4 core resilience patterns: elasticity (scale up), isolation (contain failures), healing (auto-recover), redundancy (multiple paths).
OBSERVABILITY = logs, metrics, traces. This game shows you: threat type, effectiveness, SLO, HP. Real incident response = same: understand the failure, apply the fix.
INCIDENT RESPONSE WORKFLOW = (1) Detect threat, (2) Classify incident type, (3) Deploy tools matched to threat, (4) Monitor recovery, (5) Post-mortem. This game = entire workflow in 5 minutes.

🔥 FIREWALL (physical/cloud networking device) = AWS Security Groups, GCP Firewall, iptables. Operates at Layer 3-4 (network/transport). Blocks IPs, drops malicious packets before they reach services. IDS/IPS (Intrusion Detection/Prevention) = firewall with AI learning.
🐳 DOCKER (containerization platform) = Linux containers, cgroup resource limits, process isolation. If one container crashes, others keep running. Can restart crashed container instantly. Used by every production Kubernetes cluster.
☁️ AWS LAMBDA (serverless compute) = auto-scaling functions, handled by cloud provider. When traffic spikes, provider spins up thousands of function copies. No servers to manage. Alternative: Google Cloud Run, Azure Functions.
⎈ KUBERNETES (container orchestration) = manages 1000s of Docker containers across 100s of machines. Auto-restarts failed pods, redistributes load, manages rolling updates. Industry standard for production container orchestration.