<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-incident-simulation-exercises
description: >-
  Design, execute, and evaluate incident response simulation exercises
  including tabletop exercises, red team scenarios, and full-scale drills
  to validate response capabilities and identify gaps.
domain: cybersecurity
subdomain: incident-management
tags:
  - simulation
  - tabletop
  - exercise
  - drill
  - testing
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040", "TA0001"]
  nist-csf: ["RS.RP-1", "PR.IP-10", "RS.IM-2"]
  frameworks: ["NIST SP 800-84", "FEMA HSEEP"]
---

# Performing Incident Simulation Exercises

## Overview

Incident simulation exercises test response capabilities under controlled
conditions. Regular exercises identify gaps in procedures, tooling, and
team readiness before real incidents expose them. Exercise types range
from discussion-based tabletops to full operational drills.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Exercise planning team | Facilitator, observers, evaluators |
| Scenario library | Realistic incident scenarios by type |
| Response team availability | Participants scheduled and briefed |
| Evaluation criteria | Measurable objectives for each exercise |

## Key Concepts

### Exercise Types

| Type | Duration | Participants | Realism |
|------|----------|-------------|---------|
| Tabletop | 2–4 hours | 8–15 people | Discussion-based |
| Walkthrough | 4–8 hours | 10–20 people | Step-by-step execution |
| Functional | 1–2 days | 15–30 people | Simulated environment |
| Full-scale | 2–5 days | 30+ people | Live environment |

### Scenario Template

```
EXERCISE: {name}
TYPE: tabletop | walkthrough | functional | full-scale
OBJECTIVE: {what capability is being tested}
SCENARIO:
  - PHASE 1 (INJECT): {initial alert or discovery}
  - PHASE 2 (ESCALATION): {scope expansion or complication}
  - PHASE 3 (CRISIS): {critical decision point}
  - PHASE 4 (RESOLUTION): {containment and recovery}
EXPECTED ACTIONS:
  - {action 1 with time expectation}
  - {action 2 with time expectation}
EVALUATION CRITERIA:
  - Detection: Was the inject identified correctly?
  - Triage: Was severity assessed accurately?
  - Communication: Were stakeholders notified timely?
  - Containment: Were containment actions appropriate?
  - Documentation: Was the incident properly documented?
```

### Inject Schedule

```
TIME     INJECT                              EXPECTED RESPONSE
T+0      Alert: unusual outbound DNS traffic Triage and investigate
T+15     Malware detected on endpoint        Isolate host, preserve evidence
T+30     C2 beacon to known bad IP           Block IP, hunt for lateral movement
T+45     Data staging detected on file share  Contain file share, assess scope
T+60     Exfiltration attempt via HTTPS       Block exfil, executive notification
T+90     Media inquiry about breach           Activate comms plan
```

## Workflow

1. Select exercise type based on maturity and objectives
2. Design scenario with realistic injects and timeline
3. Brief participants on exercise rules and scope
4. Execute exercise with timed injects
5. Observe and document response actions
6. Conduct hot wash immediately after exercise
7. Produce after-action report with findings and improvements

```bash
# Create a new exercise scenario
node agent.js create-scenario --type tabletop \
  --name "Ransomware Response" --phases 4

# Execute exercise with timed injects
node agent.js run-exercise --scenario ransomware-tabletop

# Generate after-action report
node agent.js after-action --exercise-id EX-2026-003
```

## Verification

- [ ] Exercises conducted at least quarterly
- [ ] All critical runbooks tested within 12 months
- [ ] After-action report produced within 5 business days
- [ ] Identified gaps tracked as remediation items
- [ ] Exercise findings incorporated into runbook updates

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- NIST SP 800-84
