[mcv]

I'm a fairly new GM, still trying to figure out the Matrix. I'm about to run an adventure from Sprawl Wilds, and I've got a question about how IC really works. I know the adventure was originally written for SR4, and has been converted to SR5 for its inclusion in Sprawl Wilds, and I think that conversion missed the Matrix stuff.

In the adventure, an outside group has meddled with an otherwise fairly harmless control system (a "node", which doesn't exist in SR5). When a PC decker looks at it, it turns out there's active IC in it. The adventure doesn't specify what kind of IC, but does specify it's loaded with the Armor, Black Hammer, Stealth and Attack programs. The node itself is loaded with a Data Bomb 4. I think in SR5 the Data Bomb should be attached to a file, right?

From what I understand from SR5, IC is always tied to a host, so should this node (which seems very small) be its own host? Normally, only Patrol IC is active and only when it or the host discovers intruders, does the host launch other IC.

My impression is that non-patrol IC is blind without the guidance of either patrol IC perceiving the intruder, or the host's marks on the intruder. In this particular case, the IC is actually meant to attack legitimate users of the system, so the usual discretion is not required; the IC will attack as soon as it detects anyone at all.

What is the best way to handle this in SR5?

Hosts are supposed to be big systems, and not some stand-alone device, which this seems to be. Yet the idea of encountering IC here is cool, so it should be possible. In a sense, SR5 seems hurt by the absence of nodes. On the one hand, I want the system to feel like it's smaller than a full-blown host, but at the same time, it should clearly be able to do the things a host does.

What I'd like, is if the IC is immediately aware of the intruder (unless running silent?) and going on the attack, but once defeated, no other IC will be launched, because it's not actually a host. I guess it's a house rule that makes a 'node' a kind of host that can have IC but not launch it independently?

Would this make sense? Is there a better, more rule-abiding way to handle this situation (from an official SR5 adventure)?

[Ixal]

Would it make sense for the adventure that the outside group couldn't fully take over the host and instead left an agent running there set to attack anyone that enters?
In that case you could have the system be a device and the agent attacks anyone that looks at it too hard. But then you would have GOD to worry about as you are not inside a host.

How exactly do you want this system to behave?

[Hobbes]

"Small" Hosts in 5e are just low rating.  And they can be abandoned.  Businesses go under.  Facilities are left empty.  Hosts don't die.  Hosts can be "Stand Alone" systems, for whatever reason.  If the plot calls for the Host to be "offline" then it is.  Kill Code goes into a bunch of details about oddball Hosts.  Offline, abandoned, or whatever. 

Pick an appropriate rating.  Patrol IC are standard, Blaster and Tar Baby are also about as standard as it gets.  And yes, if the Patrol IC spots an intruder the Host can launch IC.  If there are still security devices or whatever slaved to the Host they'd still work normally too. 

Data Bomb, attached to a file, correct.  I'd ignore that bit unless there is some kind of Data the PCs are after.  Whatever the control node was controlling the is just slaved to the Host and could be used for Direct Access.

In 5e the Hacker is toast when Host starts launching IC.  It's a never-ending Horde mode.  Most Deckers focus on not getting detected.

[mcv]

Would it make sense for the adventure that the outside group couldn't fully take over the host and instead left an agent running there set to attack anyone that enters?

I suppose. Actually changing ownership may not be plausible, it's just meant to be severely compromised. I can imagine an Agent is the more correct way to handle this, but I'm not quite up to date on the rules on Agents yet.

In that case you could have the system be a device and the agent attacks anyone that looks at it too hard.

That's pretty much what I want.

But then you would have GOD to worry about as you are not inside a host.

It might be on an unofficial grid. The adventure paints the Matrix in that location as an unreliable, non-mainstream, guerilla system where connections drop constantly. Worse than a regular public grid, it seems. So it might be outside the responsibility of grid overwatch.

"Small" Hosts in 5e are just low rating.

This node has a rating of 4. I don't know enough of SR4 Matrix rules to judge whether that is as hard to hack as a rating 4 host or not.

  And they can be abandoned.  Businesses go under.  Facilities are left empty.  Hosts don't die.  Hosts can be "Stand Alone" systems, for whatever reason.  If the plot calls for the Host to be "offline" then it is.  Kill Code goes into a bunch of details about oddball Hosts.  Offline, abandoned, or whatever. 

I think the main problem here is that the system itself is too small to be a host in the Kill Code sense. There, hosts are massive things built out of the mysterious Foundation stuff (though indeed not all hosts are). The system in the adventure is just one limited system to control one specific function, and it's been thoroughly compromised. Treating it as a host feels wrong, but a stand-alone device seems too limited.

Pick an appropriate rating.  Patrol IC are standard, Blaster and Tar Baby are also about as standard as it gets.  And yes, if the Patrol IC spots an intruder the Host can launch IC.  If there are still security devices or whatever slaved to the Host they'd still work normally too.

This is another reason I think a host is too big for this. My impression from the adventure is that there's only a single IC there, already waiting and active to attack anyone who gets too close. I think Ixal's suggestion of treating it as a compromised device with a hostile Agent might be the best approach. I need to read up on what Agents do, though.

Data Bomb, attached to a file, correct.  I'd ignore that bit unless there is some kind of Data the PCs are after.

Yeah, it's not about data, it's about changing the way some machinery is running. Though in Unix terms, the connection to a controlled device is just a special sort of file, so I was already treating databomb like that.

In 5e the Hacker is toast when Host starts launching IC.  It's a never-ending Horde mode.  Most Deckers focus on not getting detected.

Yeah, here the IC is meant to get defeated. Launching a neverending horde of IC is probably not what I need here.