Facilitate a fictional security-incident tabletop with timed injects, an evidence log and a post-exercise improvement plan.
A fictional workshop team receives an alert about unusual organizer-account logins. At minute 10 a draft file is reported publicly accessible; at minute 20 a staff member reports a suspicious approval email. These are exercise injects, not actual incidents or proof of compromise.
| Exercise minute | Inject |
|---|---|
| 0 | Unusual login alert |
| 10 | Draft file reported public |
| 20 | Suspicious approval email |
| 30 | Leadership asks for status |
A tabletop practices reasoning and coordination without taking production actions. Define facilitator, incident lead, technical reviewer and recorder roles. State the exercise boundaries and escalation rules. SIEM and SOAR concepts help explain evidence and coordination, but the project does not install those platforms.
Write the exercise charter and role cards.
Tabletop charter
Record your result and evidence here or in a separate file.
All materials say EXERCISE and prohibit real containment actions.
Make the scope visible on the first page of every inject.
Triage asks what is known, what is uncertain and what evidence is needed next. Preserve the difference between an alert and a confirmed event. Record source, time and confidence. Avoid inventing log details that the inject does not provide. The team may request evidence in the simulation without receiving a fabricated answer.
Apply the minute-0 inject and record three evidence requests.
Triage log
Record your result and evidence here or in a separate file.
Unknown account activity is not labeled confirmed compromise.
Use known, assumed and unknown columns.
Containment decisions trade speed, evidence preservation and business impact. A tabletop should compare options and identify who can authorize them. The exercise does not execute account locks or remove files. Record the conditions under which a real response would be considered and the information needed to proceed.
Discuss the minute-10 and minute-20 injects and log proposed decisions.
Decision timeline
Record your result and evidence here or in a separate file.
Each proposed action has an owner, reason and authorization condition.
Replace immediate action claims with simulated decision wording.
A status update should distinguish verified facts, current impact, actions under consideration and the next update time. Do not reassure beyond the evidence or speculate about an attacker. This is a writing exercise; messages are not sent to any real recipient. Keep the audience’s decision needs in view.
Draft the minute-30 leadership update in 150 words.
Exercise status draft
Record your result and evidence here or in a separate file.
The draft contains no unsupported breach attribution or false all-clear.
Label the unknowns and state the next evidence step.
An after-action review examines the process rather than assigning blame. Separate observed coordination gaps from imagined failures. Give each improvement an owner, due date and completion evidence. A tabletop can reveal unclear roles, but it does not prove that technical controls or recovery procedures work in production.
Write an after-action report with three prioritized improvements.
Improvement plan
Record your result and evidence here or in a separate file.
Each action traces to an exercise observation.
Remove generic recommendations that no inject or decision supports.
Deliver the charter, role cards, four injects, evidence log, decision timeline, unsent status draft and after-action plan. Run it as a solo rehearsal or with consenting participants and record only what actually happened.
Every artifact is marked EXERCISE and no real containment action, message or incident outcome is claimed.
| Criterion | Points | Evidence |
|---|---|---|
| Evidence and correctness | 30 | Calculations, source use and results match the supplied case; limitations are honest. |
| Required artifacts | 30 | All five stage outputs and the capstone handoff are present and inspectable. |
| Reasoning and decisions | 20 | Choices, assumptions, alternatives and the case-specific critical condition are explained. |
| Reproducibility | 10 | A reviewer can follow the stated steps and distinguish expected from observed results. |
| Clear communication | 10 | Labels, units, structure and evidence references make the work easy to review. |
Score at least 80/100, supply every required artifact, and satisfy the path-specific critical condition. Rework missing evidence before marking complete.
The timeline contains four planned injects at 0, 10, 20 and 30 minutes. The first alert does not establish the cause of the reported file exposure. A good log preserves these as separate evidence items until the simulated investigation connects them.
This is a discussion rehearsal, not incident response on a real system or proof of operational readiness.