<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Conducting Tabletop Exercises

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js design-scenario --type ransomware --complexity medium` | Design a tabletop exercise scenario |
| `node agent.js facilitation-guide --scenario ransomware-ttx.json` | Generate facilitation guide |
| `node agent.js schedule --participants exec,it,legal,comms --duration 2h` | Schedule and plan exercise |
| `node agent.js after-action --exercise TTX-2026-003 --observations obs.json` | Generate after-action report |

### Examples

```bash
# Primary workflow
node agent.js design-scenario --type ransomware --complexity medium

# Secondary analysis
node agent.js facilitation-guide --scenario ransomware-ttx.json

# Generate deliverable
node agent.js schedule --participants exec,it,legal,comms --duration 2h

# Measure and report
node agent.js after-action --exercise TTX-2026-003 --observations obs.json
```

## External Tools

| Tool | Command | Purpose |
|---|---|---|
| NIST SP 800-84 | `reference` | Guide to Test, Training, and Exercise Programs |
| Miro | `miro --board ttx-scenario` | Collaborative scenario visualization |
| Teams/Zoom | `teams --meeting ttx-exercise` | Remote TTX facilitation |

## Scenario Library

| Scenario | Complexity | Duration | Key Stakeholders |
|---|---|---|---|
| Ransomware attack | Medium | 2 hours | IT, Legal, Exec, Comms |
| Data breach (PII) | High | 3 hours | Legal, Privacy, IT, Exec |
| Insider threat | Medium | 2 hours | HR, IT, Legal, Security |
| Supply chain compromise | High | 3 hours | IT, Procurement, Legal |
| BEC wire fraud | Low | 1.5 hours | Finance, IT, Exec |
| Cloud account takeover | Medium | 2 hours | IT, Security, DevOps |
