<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Conducting Tabletop Exercises

## Exercise Schema

| Field | Type | Description |
|---|---|---|
| `name` | string | Exercise codename |
| `type` | enum | ransomware, phishing, supply_chain, insider, cloud |
| `difficulty` | enum | beginner, intermediate, advanced |
| `duration_minutes` | int | Planned exercise length |
| `participants` | list | Roles and participant counts |
| `injects` | list | Timed scenario events |

## Evaluation Scoring

| Score | Label | Description |
|---|---|---|
| 1 | Not Demonstrated | Action not taken or incorrect |
| 2 | Partially | Some correct elements, incomplete |
| 3 | Adequate | Met expectations with minor gaps |
| 4 | Excellent | Exceeded expectations, proactive |

## After-Action Report Fields

| Section | Content |
|---|---|
| Summary | One-paragraph exercise overview |
| Strengths | What went well (bulleted) |
| Gaps | What needs improvement (bulleted) |
| Recommendations | Specific remediation actions |
| Action Items | Tracked tasks with owners and dates |
| Next Exercise | Scheduled follow-up date and scenario |

## Agent Script

```bash
# List scenario templates
node agent.js list

# Get specific scenario
node agent.js get ransomware

# Create exercise plan
node agent.js create --scenario ransomware --date 2026-06-15 \
  --participants "SOC_T1" "SOC_T2" "IC" "IT_Ops" "Legal" --duration 180

# Generate after-action report
node agent.js aar --exercise "Operation Shadow Broker" \
  --strengths "Fast IOC identification" "Good EDR usage" \
  --gaps "Escalation delay" "No legal notification" \
  --recommendations "Update IR playbook" "Monthly mini-TTX"
```
