<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-tabletop-exercises
description: >-
  Design and facilitate tabletop exercises (TTX) for incident response scenarios
  including ransomware, data breach, insider threat, supply chain compromise,
  and business email compromise with structured facilitation guides.
domain: cybersecurity
subdomain: security-awareness
tags:
  - tabletop-exercise
  - incident-response
  - scenario-planning
  - ttx
  - crisis-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Conducting Tabletop Exercises

## Overview

Tabletop exercises (TTX) test organizational incident response capabilities through
facilitated scenario walkthroughs. This skill covers scenario design, participant
selection, facilitation guides, inject scheduling, observation tracking, and
after-action report generation aligned to NIST SP 800-84.

## Prerequisites

| Requirement | Install |
|---|---|
| Scenario library | Pre-built incident scenarios |
| Facilitation guide | Structured question sets per inject |
| Participants | Cross-functional stakeholders identified |
| IR plan | Existing incident response plan to test |

## Commands

| Command | Description |
|---|---|
| `node agent.js design-scenario --type ransomware --complexity medium` | Design a tabletop exercise scenario |
| `node agent.js facilitation-guide --scenario ransomware-ttx.json` | Generate facilitation guide |
| `node agent.js schedule --participants exec,it,legal,comms --duration 2h` | Schedule and plan exercise |
| `node agent.js after-action --exercise TTX-2026-003 --observations obs.json` | Generate after-action report |

## Workflow

### Step 1 — Assess Current State

Evaluate existing capabilities and identify gaps before implementing changes.

```bash
# Run assessment with agent tooling
node agent.js design-scenario --type ransomware --complexity medium
```

### Step 2 — Plan and Design

Define objectives, scope, timeline, and success criteria.

```bash
# Plan implementation
node agent.js facilitation-guide --scenario ransomware-ttx.json
```

### Step 3 — Execute and Deliver

Implement the planned activities and deliver outputs.

```bash
# Execute delivery
node agent.js schedule --participants exec,it,legal,comms --duration 2h
```

### Step 4 — Measure and Optimize

Track results against success criteria and iterate.

```bash
# Measure results
node agent.js after-action --exercise TTX-2026-003 --observations obs.json
```

## Verification

- [ ] Prerequisites validated and tools installed
- [ ] Assessment of current state completed
- [ ] Implementation plan documented and approved
- [ ] Execution completed per plan
- [ ] Results measured against defined KPIs
- [ ] Findings documented and next steps identified
