Shadowrun Play > Rules and such
[6e] Patrol IC
ammulder:
I've looked at several Matrix FAQs but they seem to overlook IC in the included examples.
Let's say a hacker makes it into a host via Backdoor Entry.
My understanding is that the hacker thus appears to be legit, and has no need to hide or run silent.
If the host is running Patrol IC, I assume it would make its usual Matrix Perception check of 2xHost Rating, vs. the hacker's Willpower+Sleaze, just on the principle of "confirm all icons present here are really legit". Since ties go to the acting party, does the IC need only a tie to identify the hacker, or does it require a net success? I've seen it argued that matrix perception is just like regular perception, but I'm not clear that's really true: regular perception is not opposed but has thresholds based on how obvious the event is, and I'm not clear on how that could be applied to hacking events. It seems like the opposed test is the relevant style here.
Anyway, if the IC fails, I guess it won't get around to try again on the hacker's icon for another minute.
Now, if the hacker had gone in via Brute Force instead, then the Host knows it's being hacked. However, maybe it doesn't know the hacker is the one who hacked it? I mean, the hacker might be the only icon that happens to have appeared just as the alarms starting going off, but maybe computers are stupid because this new icon does appear to be an administrator?
Then what?
I guess I'm not clear in the Brute Force case whether Patrol IC becomes redundant and serious IC should be released immediately, or whether the Patrol IC still needs to identify the attacker but maybe due to the alarm it attempts every round because it knows there's a hacker present? Does the hacker need to run silent upon Brute Forcing in order to cause a check rather than be immediately subject to nastier IC?
There was the recommendation to release progressively nastier IC as the Overwatch score goes up, but I'm not clear how that would interact with Patrol IC and whether it does or doesn't spot the hacker.
(The bottom line is, I want a weakly-defended facility that leaves its defenses primarily to things like drones and IC rather than paying by the hour for meat bodies and matrix spiders. And the key data in that facility will be in a tougher but offline host where no "on call" spider could reach it anyway.)
Xenon:
--- Quote from: ammulder on ---Let's say a hacker makes it into a host via Backdoor Entry.
My understanding is that the hacker thus appears to be legit, and has no need to hide or run silent.
--- End quote ---
This was the case in previous edition. This have been deliberately changed.
In this edition it will be immediately obvious that an intruding hacker is not a legit user or admin. If you are not running silent then you will be automatically detected as an intruder when Patrol IC get around to take a perception test. If you are running silent then you get to oppose this test and hopefully you can remain undetected for awhile longer.
As soon as Patrol IC detect you, the Host will realize that you are an intruder, it will go on high alert and it will start to launch IC.
--- Quote from: ammulder on ---regular perception is not opposed but has thresholds based on how obvious the event is
--- End quote ---
When a physical adept physically infiltrate a facility his Stealth + Agility will be used to oppose (or set a threshold, same thing really) for potential observers (like Drones, Guards etc) to notice him.
When a technomancer virtually infiltrate a host her Willpower + Sleaze will be used to oppose (or set a threshold, same thing really) for potential observers (like Patrol IC, Spiders etc) to notice her.
--- Quote from: ammulder on ---Now, if the hacker had gone in via Brute Force instead, then the Host knows it's being hacked. However, maybe it doesn't know the hacker is the one who hacked it?
--- End quote ---
Brute Force is an action linked to the Attack attribute which mean it is immediately obvious. The Host is aware that it is under attack, it will go on high alert and it will start to launch IC. But it can't attack the hacker before its Patrol IC can spot it (unless the intruder for some reason is not running silent).
--- Quote from: ammulder on ---There was the recommendation to release progressively nastier IC as the Overwatch score goes up, but I'm not clear how that would interact with Patrol IC and whether it does or doesn't spot the hacker.
--- End quote ---
Even if host start to launch IC it can not attack the intruder before its Patrol IC manage to spot it (but if Patrol IC start to make perception tests every combat turn instead of every minute or so then it is typically just a matter of time before the hacker is eventually spotted).
Michael Chandra:
Patrol IC already makes Perception tests every turn. The 1/minute roll is because you're not the only thing it's watching.
ammulder:
--- Quote from: Michael Chandra on ---Patrol IC already makes Perception tests every turn. The 1/minute roll is because you're not the only thing it's watching.
--- End quote ---
But there’s no disadvantage to a brute force over a back door if the Patrol IC isn’t going to switch to making checks against you every round (or at least much more often than per minute). So even if it has just as many items to scan, I think for the game to work it has to get aggressive trying to perceive the hacker in particular following an attack action… and also presumably if their overwatch score causes other IC to deploy — because who cares what IC is running around if you’re safe for 20 rounds?
Stainless Steel Devil Rat:
Here's my own take on your questions:
--- Quote from: ammulder on ---I've looked at several Matrix FAQs but they seem to overlook IC in the included examples.
Let's say a hacker makes it into a host via Backdoor Entry.
My understanding is that the hacker thus appears to be legit, and has no need to hide or run silent.
--- End quote ---
I'd say it's more of it being a non sequitur as to whether the hacker is running silent or not. Since you didn't brute force your way in, you look like a legitimate matrix user... at first, anyway.
--- Quote ---If the host is running Patrol IC, I assume it would make its usual Matrix Perception check of 2xHost Rating, vs. the hacker's Willpower+Sleaze, just on the principle of "confirm all icons present here are really legit". Since ties go to the acting party, does the IC need only a tie to identify the hacker, or does it require a net success? I've seen it argued that matrix perception is just like regular perception, but I'm not clear that's really true: regular perception is not opposed but has thresholds based on how obvious the event is, and I'm not clear on how that could be applied to hacking events. It seems like the opposed test is the relevant style here.
--- End quote ---
1) yes, IC rolls Host Rating x 2 for its dice pools (pg. 186)
2) Patrol IC rolls Matrix Perception, and Matrix Perception is opposed by Willpower + Sleaze (pg. 182)
3) yes, Patrol IC should count as a "hostile" roll or an attack of sorts, so a tie should go to the attacker.
4) by my understanding, whether you're running silent or not you roll Willpower + Sleaze vs Patrol IC. If it is successful, it knows you don't belong whether you were running silent or not.
--- Quote ---Anyway, if the IC fails, I guess it won't get around to try again on the hacker's icon for another minute.
--- End quote ---
Yes, if the test fails, you've got another potential minute before getting spotted by the Patrol IC. Note that:
5) Spiders or other users might notice you doing shenanigans, depending on the circumstances
6) If you bring in 5e assumptions, Patrol IC will scan you more or less often depending on the circumstances
7) I recommend you do NOT bring in 5e assumptions for variable scanning frequencies, and ignore 6). Just go with 1 scan/minute. Keeps it simple, keeps it consistent, and keeps it predictable. All good things.
--- Quote ---Now, if the hacker had gone in via Brute Force instead, then the Host knows it's being hacked. However, maybe it doesn't know the hacker is the one who hacked it? I mean, the hacker might be the only icon that happens to have appeared just as the alarms starting going off, but maybe computers are stupid because this new icon does appear to be an administrator?
Then what?
--- End quote ---
Yes, Brute Force your way in and the host is automatically on alert. IC may be dumb, but generally it's smart enough to put 2 and 2 together to realize "the host has been breached" and "this persona just came in" are related. Ergo, when Brute Forcing you DO want to come in running silent, whereas in Back Door-ing it doesn't matter. Brute Force lets the target know it's under attack, but if you're running silent it doesn't mean it automatically spots you, too.
--- Quote ---I guess I'm not clear in the Brute Force case whether Patrol IC becomes redundant and serious IC should be released immediately, or whether the Patrol IC still needs to identify the attacker but maybe due to the alarm it attempts every round because it knows there's a hacker present? Does the hacker need to run silent upon Brute Forcing in order to cause a check rather than be immediately subject to nastier IC?
--- End quote ---
Patrol IC is the eyes of the Host. If you Brute Force your way in, the host can launch a squadron of deadly IC but if they can't see you, what harm can they cause? Still, better act fast when you Brute Force :D
--- Quote ---There was the recommendation to release progressively nastier IC as the Overwatch score goes up, but I'm not clear how that would interact with Patrol IC and whether it does or doesn't spot the hacker.
--- End quote ---
It's not made very clear in the CRB examples, but you can see numerous examples of IC and Hosts in published material, I think. To give you a basic primer on how they're written for published adventures:
Hosts have a binary alert state: Prior to going on alert (in effect, a de-facto "all clear" status) hosts are running some kind or kinds of IC, or none at all. 9 times out of 10, that's Patrol IC and nothing else. Although, a host could be running with various combat IC launched 24/7. This is not the norm however, as in theory combat IC will eventually attack legitimate users due to various mis-identifications, even though there's no accounting for that in the rules per se. Most of the time, you have Patrol IC running by itself, and then when host goes on alert it launches a list of additional IC in some preset order. Once the host goes on alert, it can launch 1 IC per turn. Depending on how the host is written up, it will interrupt the launch sequence to re-launch IC that got defeated in cybercombat, or continue on with the sequence and then go back and re-launch defeated IC after the sequence is finished. Totally writer/GM fiat here on which way it works for a given Host.
--- Quote ---(The bottom line is, I want a weakly-defended facility that leaves its defenses primarily to things like drones and IC rather than paying by the hour for meat bodies and matrix spiders. And the key data in that facility will be in a tougher but offline host where no "on call" spider could reach it anyway.)
--- End quote ---
You probably want a host in the 2-4 rating range. It'll run Patrol IC constant, and have a launch sequence of something like Track, Killer, then Marker once it goes on alert. Think about what the various IC's capabilities are, and what order they should be launched in (is it more important to try to kill someone out of the gate? Probably inappropriate for a legal, above-board host... Track is a good 1st "escalated" option for those, imo).
Navigation
[0] Message Index
[#] Next page
Go to full version