How to play

Here I will quickly guide you how to use this site to create and guide players through a game session.


My Games

Creating a game

Under "My Games" the Incident Master can click on "Create new Game" to start the process. Each game requires at least a title. If you like you can enter a description to set the mood or simply send a welcome message to the users. In the "Connection" field you can enter the login data to the websharing or conference session. Description and Connection are optional.

My Games

Setting the game up

The next step is to setup the game. Click on "Setup Game" on the game details screen. This will take you to the "Setting the Board" screen where you can setup the attack scenario and shuffle the procedure cards.

My Games

Click "Setup Attack Cards" and "Setup Procedure Cards" to randomly draw attack cards or change the order of the Procedure cards. The Attack cards and the Procedure cards can be setup seperately in case you do not like the generated Attack scenario or would like to make other procedures "well known" (The first for procedure cards give a +3 modifier). Later at some point I may include the option to select the cards maually.

Once all cards are selected you can go back to the card info or start the game.

Note: Once you start the game players are able to go to the player dashboard and see the procedures!

Inviting the Players

How you invite players is up to you. I have intentionally not included a function to mail players. The most important information players need are:

  • The time the game takes place
  • The link to the site (
  • The GameKey
  • Method of communication
The GameKey is displayed on the Game Info page. Players can just copy/paste this key into the form on the homepage and are taken to the gameinfo where they can enter the player dashboard.

Unless you are projection this to a big screen and the players are in the same room you should include the method of communication (makes sense, doesn't it?). Players should be able to discuss with each other, so I would suggest at least a telephone conference or voice-chat. My preferred method is a web conferencing tool (eg. WebEx, GotoMeeting, Skype, Zoom, ....) that allows you to share the screen.

You can display an example invitation on the Game Info page.

My Games

Playing the Game

The actual gameplay takes place in the player Dashboard and the Incidentmaster Dashboard. The Incidentmaster Dashboard should not be shared with the players, as it would spoil the game. If you want to share something, share the player dashboard! Both can be reached from the Game Info page or if you are the Incidentmaster from your "List my Games" page.

The incidenmaster Dashboard shows the attack scenario at the top. Below each attack card is a slider that makes the card visible on the Player Dashboard or hides it. (Note: Once all four cards are reveald, the game is considered won and automatically ends!). Below the attack cards are the turn management controls.

The process for each turn is the same:

  1. allow the players to discuss what procedure they want to use
  2. Click "Select" below the procedure card to show all available procedures, then click "Select" below the procedure card chosen by the players.
  3. Roll a D20 (20-sided dice) and enter the result in the "Roll"-field. If you do not have a D20 click the dice icon to generate a random number between 1 and 20.
  4. If applicable (or you feel generous) enter additional Modifiers in the Bonus-field.
  5. The resulting Roll is automatically shown to the right and should be announced to the players.
  6. If a roll was successful and players chose a procedure either listed on one of the attack cards as an appropriate detection method or if you believe it is the correct procedure to use you can the slider below the card to reveal it to the players.
  7. If players roll either a 1 or a a 20 (without modifiers), fail three times (Total roll below 11) or if you think the situation demands is, you can select an Injection Card. At the moment you have to select the injection manually (I may add a random draw later). The injection card usually should be selected randomly. However sometimes it can be helpful to seleect a card on purpose to to liven up the game or to foster discussion.
  8. The "Notes" field allows you to enter notes about the current turn. These notes will be stored in the game log and can later be used in the retrospective of the game to better follow why a decision was made or what the consequences of a decision was made. (Note: For reasons of data privacy you must not enter full player names in the notes. If you want to document player comments use their first name or a nick. GameLogs can be viewed by anybody who has the GameKey, which is really no protection at all, or very weak protection!)
  9. Once you have at least chosen a procedure and entered a dice roll click "Next Turn" to conclude the turn and move to the next.
  10. IMPORTANT: The player screen does not refresh automatically. I am still thinking how to automate that at the end of a turn, so players must refresh their dashboard manually to see the results of a turn!!
The Incidentmaster Dashboard was on purpose written to allow you the Incdentmaster to handle the gameflow as flexible as possible. In the end how the game is played and managed is up to you!

End of the Game

The game automatically ends if either all attack cards are set to revealed (in which case the game is considered to be won) or if ten turns have been used without all attack cards revealed (in which case the game is considered lost). If either condition is met players and Incidenmaster are taken to the Game Result where the lose- or win-notice is shown. In addition all turns of the game will be listed allowing you to review the game. This game result is stored for 90 days and can be accessed via the Game Info page.

Some Tips and Tricks

Here I would like to share a few tips and tricks about conducting a successful game:

Create an interesting back story

Once you have setup the attack scenario, think about a backstory, that will give players some initial information about what happened and how users or operations found out that something is wrong. You can include hints or maybe even some disnformation (afterall the information is not always precise or even correct ;) ).

Those of you having a background as a DnD Dungeonmaster know, that a captivating backstory is important: You enter the office after your lunch break and notice users in a blatant panic. One user is blocking the door. What do you do?

Keep the discussion going

At some point you may notice that discussion tapers down and the players sit there without a clue what to do. Do not let the silence keep for too long. As an Incidentmaster you could either give users a hint ("All of a sudden the phone rings and the CEO complains about a strange popup on his laptop asking for a ransom") or you can use an injection card to add some liveliness.

Try to involve all players

Sometimes you may find that one player dominates the discussion or one player being very quiet not daring to voice his/her opinion. You can silence the "over-active" by purposefully employing an injection card, or ry to encourage the silent player by asking him/her directly. This game lives from the interaction of the players and it is your responsibility as the incidentmaster to foster it.

Getting support or make a suggestion

if you need help, have a question, or a suggestion, feel free to contact me at bnb-support (at) or or use the contact form.