Launching the Demo
Launch the console application by downloading and running the jnlp file. Accept the terms of the evaluation license. Select "fullscreen" from the next window - and choose the native full resolution of your screen. If you have a decent graphics card, enable some antialiasing. Once you are in the console, press 'u' to start the demo feed. The help overlay will come up - you can dismiss it by pressing 'h'.
What am I looking at?
You should read the Timewell Manifesto
, which explains the principles of the timewell visualization. The demo feed sends simulated traffic into the console, representing the network activity of an organization with three floors of employees (internal), a datacenter with three subnets (datacenter), and a group of systems adminstrators (grp.sys). Hit the 'l' key (lower-case L) to turn off/on node labels, and zoom into the tree using the 'w' key ('s' zooms back out). Use your mouse to highlight the various nodes (spheres).
The Object of the Game
Two of the systems administrators working for this organization are either preparing to exfiltrate data, or are actively exfiltrating it. The object of the game is to "flag" the nodes representing those two admins, and only those two admins. You can flag a node by mousing over it and then using the HUD menu in the lower right-hand corner of the screen. Once a node is highlighted, hit 'enter' ('return' on mac) to activate the HUD menu; arrow down until the "flag" line is highlighted; and hit 'enter' again.
The solution is here