# Jade Palace Cyber Mystery

## 🧩 Jade Palace – Game Master Cheat Sheet

#### 🎮 Game Summary (KC7 Platform)

**Scenario Premise:**\
Po is confused after being unexpectedly defeated by Tai Lung. He had trained hard and even developed secret techniques, which he logged privately on his device. The defeat raises suspicions—how did Tai Lung know his moves?

**Technical Investigation (in KC7):**

* Students analyze email logs and file activity.
* They discover that Po clicked a link in an email from “BadLeopard.”
* This led to the download of a suspicious file, suggesting malware execution.
* Additional evidence from Master Shifu’s machine shows lateral movement and further compromise.
* Students begin forming a theory of how Po’s secret moves were leaked.

#### 🧾 How the Physical Artifacts Fit In

While students are digging through KC7 logs, they also move through the room collecting **physical artifacts** that expand the narrative and help identify the **people** behind the breach. These artifacts allow students to bridge the “what happened” (KC7 data) with the “who and why” (real-world motives and context).

| Artifact                                | Purpose / Narrative Tie-In                                                       |
| --------------------------------------- | -------------------------------------------------------------------------------- |
| **Po’s Notes on Secret Moves**          | Confirms Po was documenting techniques digitally—likely the target of the breach |
| **Tai Lung Email Printout**             | The phishing email Po clicked; visually reinforces the phishing storyline        |
| **LeopardFanBlog Post**                 | Builds character background; hints at obsession or inside knowledge              |
| **Poster for Kung Fu Legends Tryouts**  | Likely the lure used in the phishing email; explains the pretext                 |
| **Confidential Tournament Entry**       | Suggests identity spoofing or unfair access to Po’s information                  |
| **Daily Schedule of Training Sessions** | Can help determine timeline and opportunity for espionage                        |
| **Tournament Judges List**              | Could reveal conflict of interest or compromised insider                         |
| **Witness Statement - Monkey**          | Offers an unreliable narrator or side clues to triangulate evidence              |
| **Case Manager Packet**                 | The main worksheet for teams to track progress and summarize findings            |
| **Criminal Referral Form**              | Where teams formally name two suspects (Subject A and B) and explain why         |

#### 🔍 Investigation Flow (Suggested)

Here’s a recommended flow of how students should approach the challenge:

1. **Begin with KC7 Investigation**
   * Identify the email Po clicked
   * Find the downloaded file and malware activity
   * Look for signs of lateral movement to Shifu’s account
2. **Assign Team Roles**
   * Case Manager, Investigator, Presenter, Analyst
3. **Search for Physical Clues**
   * Teams explore the room to gather documents
   * They compare these artifacts with what they saw in KC7
4. **Fill Out Case Packet + Referral Form**
   * Evidence is organized in the Case Manager Packet
   * Attribution decision is made in the Criminal Referral Form
5. **Present or Submit Conclusions**
   * Teams explain how the attack happened and who was responsible

***

#### 👨‍🏫 Facilitator Tips

* **Don’t rush students.** The real challenge is connecting logs to human motives—this takes time.
* **Encourage citing evidence.** When teams name suspects, ask “what makes you say that?”
* **Keep the energy high.** Move between groups, prompt questions, and highlight creative thinking.
* **Add layers.** Use props, music, or classroom lighting to make the atmosphere feel like a dojo or investigation war room.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.kc7cyber.com/camp/jade-palace-cyber-mystery.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.