Free Security Incident Tabletop Learning Path
The response room

GOAL
Facilitate a fictional security-incident tabletop with timed injects, an evidence log and a post-exercise improvement plan.

START
Read workbook.html, inspect case-data.csv, complete the five stage outputs, then the capstone. Use evidence-log.csv to record only actions actually performed.

CASE
A fictional workshop team receives an alert about unusual organizer-account logins. At minute 10 a draft file is reported publicly accessible; at minute 20 a staff member reports a suspicious approval email. These are exercise injects, not actual incidents or proof of compromise.

TOOLS
Basic security vocabulary. Use documents only; no real systems, accounts or messages are affected.

LOCAL COMMANDS / OPENING
Open workbook.html in a browser; complete the case-specific worksheets in your preferred free editor or on paper.

ASSESSMENT
Score at least 80/100, supply every required artifact, and satisfy the path-specific critical condition. Rework missing evidence before marking complete.
Critical condition: Every artifact is marked EXERCISE and no real containment action, message or incident outcome is claimed.

SOURCE COURSES
Free Security Operations Course: SIEM, SOAR and EDR — https://wikifree.com/courses/free-security-operations-course-siem-soar-and-edr/
Free Cybersecurity Architecture Course: Identity to Response — https://wikifree.com/courses/free-cybersecurity-architecture-course-identity-to-response/

RIGHTS AND SCOPE
Original WikiFree teaching case and exercises. All case data are synthetic. Provider lessons are linked, not redistributed. No certificate, real project delivery or unperformed runtime test is claimed.
