[Typhus]

For whatever reason, let's say my character wants to sit back and just try to defend the team's gear (PANs, let's assume) from enemy cyberattacks.

What am I doing each turn?  If a cyber attack happens, what do I "see" in the Matrix?  Can I do the technological equivalent of "counterspelling"?  Or do I just have to locate the troublemaker and try to splat their gear first?  What are my options?

[Banshee]

The most likely thing your doing is taking the Full Matrix Defense action which let's you add you Firewall (this usually means you get it twice)

[Stainless Steel Devil Rat]

Mechanically, what you're doing is using your superior mental stats/gear to roll defense tests in place of your teammates'. Proactive actions are things like trying to spot silent running personas, engaging in cybercombat with the attackers, and so on.

In-universe, what you see depends on several things.  Like: whether you're in AR or VR, whether the attacker is close enough to see physically or if they're on the other side of the sprawl, and etc.
Generally, I'd narrate that the matrix defender is watching/noticing anomalies on the team's defended devices.  Once you begin to detect signs of brute force or back door entry, you switch from a passive role to something reactive, or maybe even proactive if and when you spot the attacker.

[Typhus]

Can you "see" the attack signal in any way?  Other than a device starting to act up (which I assume you notice due to linking team PANs to your deck), you wouldn't be able to detect the attacker themselves.

So I get that the mechanic to "find an icon" is Matrix Perception.  Fine and dandy, but how do you know who/what to search for?  Would that be the Trace Icon action?  How do I detect and locate the specific device hassling my crew?  Trace Icon action?  Or just that Matrix Perception process, regardless of meatspace location?

[Stainless Steel Devil Rat]

Matrix Perception is the game equivalent of a "google search".  Geographical location is irrelevant for Matrix Perception (indeed ANY matrix action), barring of course potential Noise penalties.

Data Spikes (and Technomancer analogues) can normally be seen in AR/VR- those are the lightning bolts, blown kisses, or whatever fits the attacking persona's personal motif. 

Now the more subtle stuff, that usually doesn't give off simsense visuals.  That's kind of the point in being subtle, afterall!  In 5e, you'd examine the MARK(s) placed by a hostile hacker, and you'd then begin your Matrix Perception based on what you saw from the MARK icon(s).  Since 6we dispenses with the MARK concept, it gets a little fuzzy yes. It's probably for the best gameplay that once you know hacking shenanigans are afoot, you already know enough to begin your Matrix Perception for the guilty party.  Assuming of course, they're both in your immediate area and not running silent, then a Matrix Perception won't even be necessary.

[Banshee]

Correct, basically anything that is attack based (i.e. Brute Force and Data Spikes for example) are not subtle so if you're actively aware you should see them coming without much trouble. Subtle Sleaze based actions may not get noticed until something gets triggered or goes wrong then there is no reason you can't attempt at Perception check at that point to identify the source.

[Typhus]

Where does a Spoof Command attempt fall in that spectrum?  Obvious or subtle?  Where should the dividing line be?

[Banshee]

Where does a Spoof Command attempt fall in that spectrum?  Obvious or subtle?  Where should the dividing line be?

Spoof Command is sleaze based I believe (or at least was during design) so would be subtle but but may have obvious results

[Typhus]

So maybe, "attack" = obvious "sleaze" = subtle, meaning it needs to be traced?

[Banshee]

So maybe, "attack" = obvious "sleaze" = subtle, meaning it needs to be traced?

Yep, thought I said that earlier. Sorry if I didn't... I should probably be working instead of watching the forum on my phone. 😎

[Typhus]

Nah, you did.  My bad.  Same distraction issue.   

[Xenon]

In SR5 an attack action was obvious and it was enough to be "aware" of the attacker which meant you could take a perception test to spot it. If the offender was running silent then it would get to oppose the test to be found. If not and also in physical proximity or within the same host then you would automatically spot it.

Translated to SR6 it seem as if you would automatically spot an attacker unless the network the offender is hiding behind is running silent in which case you first need to take an opposed matrix perception test to spot the silent running network.

[Typhus]

I still don't think I have this clear, but I feel like I am probably closer.  There's two levels of awareness we're talking about here.  Hack Detection and Seeing the Icon.

There's no text on how to detect an attack/sleaze attempt (successful or not).  Its not even clear what's happening when I am making a defense roll.  Am I aware something is happening or is this a passive event that my system is dealing with?  Or is that the difference between Full Matrix Defense and not? 

The text in 5e says I become aware of a sleaze attempt if it fails, but only an attack attempt if it succeeds (which seems backwards to me).  Regardless of that, would this still be a valid interpretation in the world of 6e? Since the editor's pen has altered the RAI, maybe there is not "right answer" here, which, well, there we are. 

Seeing the icon responsible for the hack is also not really described.  Per Banshee's statement, an attack action is meant to be obvious.  I'm rolling with that for now as the closest statement I can find to authoritative.  Per that, iconography is even assumed to accompany it the attack in theory.  So, in VR or AR overwatch mode, regardless of my rolls, I would "see" the attacking persona appear next to the icon and try to Brute Force it.  I can now target that attacker without needing to roll to "find" them.  If they were Running Silent before the BF action pretty much spoils that effect?  Or are they still not visible in AR unless I use MP to find them normally?

However, if they try to sleaze their way in, and are running silent (and why wouldn't they be?), I wouldn't see anything in AR/VR in that moment.  However, I would be making a defense test, so I am detecting a hack just on that action alone, no?  However (assuming they are running silent) I don't have a visual cue yet (my deck hasn't "seen" the source device).  I defend the hack attempt, but then what?  Do I know someone attempted a hack or not?

Once I know I was hacked, to locate the attacker, do I ever use the Trace Icon action or just Matrix Perception to find the offender?  Or does Trace Icon only apply if I want to see where their device is in meatspace?  MP shows me the device I want to go revenge mode on, but not where the body is that's connected to it, IIUC?

Assuming the more logical takes on the answers here, this is my working theory:

Enemy Hacker, Running Silent, decides to hit my team's gear.  I'm in VR.  I see nothing yet.

(1) I make my defense test against the hack (whatever type it is) with Full Matrix Defense in play since that was my plan to defend the gear.

  (A) If the hack was a BF attack, it's an Attack-linked action.  I detect it happen in VR, because my deck (Per Banshee I guess it autodetects attack actions?).  It shows me an attack occurring with whatever iconography the user has running.  I still can't target his icon (nor even see it) because he is running silent.  I use MP to find the bugger and start to fight back once i spot him.  I still don't know where he is in meatspace without the Trace Icon action.

 (B) If the attack was a Probe attack, it's a Sleaze-linked action.  I do not detect it (even though my character is rolling against it) because they are running silent.  If they make the roll against me, they get the access they wanted.  Am I aware a new user has joined the network even, or was that part of the successful sleaze effort and I don't know drek until they take an action I do successfully defend against, or I see a Convergence event descend on them for holding the hack open too long? 

This also brings up that Full Matrix Defense as published is confusing as well.  It's a Major Action, but is that what "prevents you from attacking"?  Also, "the next time you are attacked" would appear to make this read that I can go on FMD for one Major action, and then regardless of what I do afterwards, my next defense test gets the Firewall benefit, even if it's 10 rounds later.  The only limitation might be that I can't take attack actions myself during this time with any other actions I want to spend.  It's got zero details on how to play this out, that I can see so far.  It also doesn't say how long this effect lasts. In 5E, it was specifically like a full defense in combat, which would be the more sensible interpretation.  That just leaves the "can't attack" rider in question.  If I am running hot sim VR, should I be able to use my second Major on that same turn to attack or not?  Also, in 6, FMD is not a reaction effect (ie an "anytime action"), even though Full Defense is.  You would have to play it before things happen to you, by RAW.  Seems like an error there.  I would allow it as an AA, since that's it's legacy.

LAST NIT TO PICK:
Data Spike is not tagged as an Attack-linked action in the text.  Is that on purpose, or an errata item? 

It would be awesome to somehow see the original Banshee draft. 

[Banshee]

Ok, trying to be concise but still answer your questions.

Scenario A: yep, you're right.

Scenario B: yeah, pretty much. The whole point of a Sleaze attack is remaining undetected, so as long as they are successful and don't force an action that triggers an obvious threat you're kind of screwed.

Yes, MP let's spot the Icon, Trace Icon let's you find where physical location is.

Full Matrix Defense at least needs somecFAQ work ... yes it's basically just the matrix version of Full Defense for Combat so any ambiguity can be cleared up if you look at FD.

Data Spike should be attack linked.

Sorry, that would violate my NDA to post .. plus it's kind of ugly since I'm not that good of a type. 😎

[Typhus]

OK, sounds like I worked out enough then.  That's enough for me to roll with for now I think.  Thank you very much for your insights.  An elf can dream though.