The ultimate test of the security operations center

Netleaf: Cyber Defence Center

Welcome to Netleaf: Cyber Defence Center, a strategic board game where players compete to build and fortify their cyber infrastructure while thwarting threats and outsmarting opponents. In this immersive game, you’ll navigate the intricate world of cybersecurity, constructing log collectors, establishing operations rooms, and acquiring valuable support cards to gain an edge. But beware, as hackers lurk and dice rolls can tip the balance of power. Engage in shrewd card trading, cleverly deploy shortcuts, and leverage your network security expertise to emerge victorious in Netleaf: Cyber Defence Center.emerging

Game info and rules

The point of the game is to get 10 victory points. You get point by building log collectors, operations rooms, getting the biggest network or workforce, and buying support cards.

Game Components

  • 19 IT hexes
  • 9 empty border hexes
  • 9 special order hexes
  • 18 circular number tokens
  • 95 component cards (with symbols of honeypots, SIEM, IDR and network sensors)
  • 26 support cards (14 SOC engineer cards, 5 security cards, 6 shortcut cards)
  • 4 building cost cards
  • 2 award cards: biggest network and biggest work force
  • 16 operations rooms (4 of each color)
  • 20 log collectors (5 of each color)
  • 2 dice
  • 1 hackerb

Constructing the board

The border hexes play a crucial role in anchoring the board and maintaining its stability. Before proceeding to build the interior, ensure that you consistently transition the border hexes from being empty to containing a component, and finally to a question hex.

Begin by arranging all the component hexes with their black side facing up on the table. Then, take turns selecting one and positioning it within the border.

Once the board is structured, proceed similarly with the circular numbers. Place them all with their black side up and take turns situating them on the table.

Starting the game

To determine the starting player, each participant rolls two dice. The player achieving the highest total begins the game. In the initial round, each player positions a log collector and a cable at a junction between two or three hexes. Following this, with your first two log collectors in place, you may lay a cable. The likelihood of rolling a specific number with the dice increases with the magnitude of the number.

Once log collectors are set, players can proceed to lay cables. Subsequently, the process repeats, starting from the last player. Players retrieve cards corresponding to their final log collector placement.

Take heed: log collectors must be built at least two cables apart, and the initial cables must not intersect.

Once all players have positioned two log collectors and two cables, the game commences. Roll the dice to determine which cards you receive. For instance, if your log collector is adjacent to a SIEM marked with a number 9 and the dice yields a 9, you acquire a corresponding SIEM card from the bank.


When a player rolls a 7, they have the opportunity to position the hacker on any numbered space on the board. Those holding more than 7 cards are required to return half of their cards to the bank. If the total number of cards is odd, players must surrender the smaller portion.

The player who rolled a 7 can select a card from the player whose headquarters or branch office is adjacent to a component hex border.

If a player’s number is covered by the hacker when a 7 is rolled, they do not receive any component cards until the hacker is relocated.

Each time someone rolls a 7, the hacker must change positions. For instance, if the hacker was positioned on number 9 on a SIEM hex, it must be moved elsewhere, such as number 8 on an endpoint hex.

Game Pieces


To construct a log collector, you must first establish cables. Once two cables are laid down, you gain permission to erect a log collector. Each cable installation requires a network sensor and an IDR. Upon connecting five cables, you qualify to obtain the highest-value network card, which is worth 2 points. However, if another player builds a larger network, they acquire the card instead.

Log collector

Begin by establishing log collectors, with the first two being set up before the game commences. For additional details, refer to the provided resource. To construct your third and fourth log collectors, you must compensate the bank with a network sensor, IDR, honeypot, and a SIEM card.

Each log collector contributes one victory point to your total.

Operations room

Once you’ve constructed the log collector, you have the option to upgrade it into an operations room by providing 3 SOAR and 2 SIEM cards.

If you possess an operations room and a nearby number is rolled, you receive two component cards instead of one.

Each operations room adds 2 victory points to your total.

Support card

Purchasing support cards grants you access to CDC engineers, shortcuts, or security cards, each offering distinct advantages in the game.

Support cards can only be utilized during your turn and prior to rolling the dice.


CDC Engineer

Using your system engineer card enables you to relocate the hacker to a number of your preference.

Upon acquiring 3 CDC engineer cards, you obtain the largest workforce card. However, if another player possesses more CDC engineer cards than you, the card transfers to that player.


Three distinct shortcut cards offer unique advantages:

  • Alt 4: Allows you to claim all resource cards of a specified type from other players.
  • Ctrl C + Ctrl V: Enables you to place 2 cables.
  • Ctrl Shift Esc: Grants you the ability to select 2 resource cards of your choice from the bank.


Obtaining any of the 5 security cards earns you a point:

  • Cloud Security
  • Email Security
  • Firewall
  • NAC (Network Access Control)
  • Remote Access


During your turn, you have the option to engage in card trading with other players or with the bank.

When trading with a player, both parties can exchange specific cards. For instance, you might swap 1 SIEM for 1 SOAR, or negotiate alternative exchange rates such as 1 SIEM for 2 SOAR. Exercise caution and strategize your trades wisely.

Alternatively, trading with the bank involves offering 4 identical cards in exchange for 1 specific card. However, if you have a log collector or an operations room positioned by the border, you can enhance your trading power. In such cases, you can trade 2 for 1 specific card or 3 for 1 card of your choice, depending on the hex where your log collector or headquarters is situated.