Area: Tolkien-Ring

Area Layout

You can only head to the right in this new area. You will first cross paths with Sparkle Redberry. Sparkle Redberry

Hey there! I’m Sparkle Redberry. We have a bit of an incident here.
We were baking lembanh in preparation for the holidays.
It started to smell a little funky, and then suddenly, a Snowrog crashed through the wall!
We're trying to investigate what caused this, so we can make it go away.
Have you used Wireshark to look at packet capture (PCAP) files before?
I've got [a PCAP](assets/suspicious.pcap) you might find interesting.
Once you've had a chance to look at it, please open this terminal and answer the questions in the top pane.
Thanks for helping us get to the bottom of this!
...

Next to Sparkle is the Wireshark Phishing Cranberry Pi terminal.

After solving the Wireshark Phishing terminal, you will receive an achievement and the Objective task will be marked as completed. You will also receive another Objective task, this one telling you to find the next objective by speaking with Dusty Giftwrap. Speak with Sparkle Redberry before moving on for some hints on the next terminal. Sparkle Redberry

You got it - wonderful!
So hey, when you're looking at the next terminal, remember you have multiple filetypes and tools you can utilize.
Conveniently for us, we can use programs already installed on every Windows computer.
So if you brought your own Windows machine, you can save the files to it and use whatever method is your favorite.
Oh yeah! If you wanna learn more, or get stuck, I hear [Eric Pursley's talk](https://youtu.be/5NZeHYPMXAE) is about this very topic.
...

Head to the right, the next NPC you cross will be Dusty Giftwrap. Speaking with Dusty will complete the objective and add the Windows Event Logs objective to your badge. Dusty Giftwrap

Hi! I'm Dusty Giftwrap!
We think the Snowrog was attracted to the pungent smell from the baking lembanh.
I'm trying to discover which ingredient could be causing such a stench.
I think the answer may be in these suspicious logs.
I'm focusing on Windows Powershell logs. Do you have much experience there?
You can work on this [offline](assets/powershell.evtx) or try it in this terminal.
Golly, I'd appreciate it if you could take a look.
...

Next to Dusty is the Windows Event Logs Cranberry Pi terminal.

After solving the Windows Event Logs terminal, you will receive 10 KringleCoins, an achievement, the task will be completed, and you will receive a new task asking you to talk to Fitzy Shortstack for the next task. Speak with Dusty before leaving to get a hint for the next terminal. Dusty Giftwrap

Say, you did it! Thanks a million!
Now we can mix in the proper ingredients and stop attracting the Snowrog!
I'm all set now! Can you help Fitzy over there wield the exalted Suricata?
It can be a bit mystifying at first, but this [Suricata Tome](https://suricata.readthedocs.io/en/suricata-6.0.0/rules/intro.html) should help you fathom it. 
I sure hope you can make it work!
...

Continue walking to the right. The next NPC you cross will be Fitzy Shortstack. Speaking with Fitzy will complete the objective and add the Suricata Regatta task to your objective. Fitzy Shortstack

Hm?.. Hello...
Sorry, I don't mean to be uncharaceristically short with you.
There's just this abominable Snowrog here, and I'm trying to comprehend Suricata to stop it from getting into the kitchen.
I believe that if I can phrase these Suricata incantations correctly, they'll create a spell that will generate warnings.
And hopefully those warnings will scare off the Snowrog!
Only... I'm quite baffled. Maybe you can give it a go?
...

Speaking with the Snowrog on the extreme right provides some expository details. Snowrog

_Fierce gusts of wind wreath about it and snow swirls in its aura_
_Its frozen mane shimmers, and chilled air fogs behind it_
_Its left hand made of fingers of tongue-affixing icicles_
_Its right a fist like that of a densely packed snowball_
_The Snowrog focuses on you with an icy-cold glare_
_And bellows a roar more thunderous than an avalanche_
...

Next to Fitzy is the Suricata Regatta Cranberry Pi terminal.

After solving the Suricata Regatta terminal you will receive the Tolkien Ring, 25 KringleCoins, an achievement, and another narrative line!

The first with bread kindly given, not sold

Speaking with Fitzy again reveals the elf is able to use an incantation that drives the Snowrog away, removing him from your screen. Fitzy Shortstack

Woo hoo - you wielded Suricata magnificently! Thank you!
Now to shout the final warning of power to the Snowrog...
YOU...SHALL NOT...PASS!!!
...

Heading left, back toward the entrance to this room, you will notice that Grinchum has appeared in this area! Speak with Grinchum to reveal a hint about hidden chests, like the one found in the Hall of Talks. Grinchum

😒_Who took you, Precious? How did they take you? Mustn't happen again._
🙂 **Oh, hello, humanses. Maybe we can offer help?**
😏 **Yes... Grinchum will help the humanses.**
_We are trying to distract them from finding the rest of you, Preciouses, with talk of hints and coinses._
🙂 **Have you found the coffers yet? The ones at the end of hidden paths?**
😏 **There's hintses in them, and coinses, they're veeerrryy special.**
🙂 **Just look hard, for little, bitty, speckles or other oddities.**
_Don't worry, they will not look for you, Preciouses. Shhh..._
🙂 **Go on, humanses. Start searching!**
...

After speaking with Grinchum, use the door at the left of this area to return to .