<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-tabletop-exercises
description: >-
  Design and facilitate tabletop exercises (TTX) for SOC teams including
  scenario development, inject sequencing, role assignments, facilitation
  guides, evaluation criteria, and after-action report generation for
  incident response readiness assessment.
domain: cybersecurity
subdomain: soc-operations
tags:
  - tabletop-exercise
  - incident-response
  - soc-training
  - scenario
  - readiness
  - after-action
  - simulation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Conducting Tabletop Exercises

## Overview

Tabletop exercises (TTX) test SOC incident response capabilities through
discussion-based scenarios without live system interaction. They validate
playbooks, identify communication gaps, test escalation procedures, and
build team coordination under simulated pressure. This skill covers
scenario design, facilitation, and post-exercise analysis.

## Prerequisites

| Requirement | Purpose |
|---|---|
| SOC team availability (2-4 hours) | Participants |
| Incident response playbooks | Baseline procedures |
| Scenario materials | Exercise content |
| Facilitator guide | Structured execution |

## Key Concepts

### Scenario Templates

```yaml
scenario:
  name: "Operation Shadow Broker"
  type: ransomware_incident
  difficulty: intermediate
  duration_minutes: 180
  participants:
    - role: SOC Analyst T1
      count: 2
    - role: SOC Analyst T2
      count: 1
    - role: Incident Commander
      count: 1
    - role: IT Operations
      count: 1
    - role: Legal/Compliance
      count: 1

  injects:
    - time: "T+0"
      title: "Initial Alert"
      content: >
        SIEM alert: Multiple endpoints reporting unusual SMB traffic
        to internal file server FS01. EDR shows suspicious PowerShell
        execution on 3 workstations in Finance department.
      expected_actions:
        - Validate alert in SIEM
        - Check EDR for process details
        - Identify affected systems

    - time: "T+20"
      title: "Escalation Trigger"
      content: >
        EDR detects Cobalt Strike beacon on FS01. Lateral movement
        confirmed via PsExec to DC01. Active Directory queries
        observed from compromised account.
      expected_actions:
        - Escalate to Tier 2 / Incident Commander
        - Isolate FS01 and affected workstations
        - Initiate IR playbook

    - time: "T+45"
      title: "Ransomware Deployment"
      content: >
        Ransom note appears on 47 endpoints. File encryption in
        progress. Attacker demands 50 BTC via Tor payment portal.
        Backup server status unknown.
      expected_actions:
        - Activate incident response plan
        - Assess backup integrity
        - Engage legal and executive team
        - Contact law enforcement if required

    - time: "T+90"
      title: "Recovery Decision"
      content: >
        Backups verified intact but 6 hours old. Attacker threatens
        data leak of exfiltrated financial records. Media inquiry
        received about potential breach.
      expected_actions:
        - Decide restore vs. negotiate
        - Assess data exposure scope
        - Prepare communications plan
        - Document evidence for legal
```

### Evaluation Rubric

```
ASSESSMENT AREAS:
├── Detection & Triage (25%)
│   ├── Alert validated within SLA?
│   ├── IOCs correctly identified?
│   └── Initial scope assessment accurate?
│   
├── Escalation & Communication (25%)
│   ├── Correct escalation path followed?
│   ├── Stakeholders notified timely?
│   └── Communication clear and structured?
│   
├── Containment & Response (25%)
│   ├── Containment actions appropriate?
│   ├── Evidence preserved before action?
│   └── Response aligned with playbook?
│   
└── Recovery & Documentation (25%)
    ├── Recovery plan feasible?
    ├── Lessons learned identified?
    └── Timeline documented accurately?

SCORING: 1=Not demonstrated, 2=Partially, 3=Adequate, 4=Excellent
```

### After-Action Report Template

```
AFTER-ACTION REPORT
====================
Exercise:    Operation Shadow Broker
Date:        2026-03-15
Duration:    3 hours
Facilitator: Senior Analyst

SUMMARY:
Team demonstrated strong initial triage but delayed escalation
by 15 minutes past SLA. Containment actions were appropriate.
Communication to legal was not initiated until inject 3.

STRENGTHS:
- Rapid IOC identification and SIEM correlation
- Correct use of EDR isolation capabilities
- Good documentation throughout exercise

GAPS:
- Escalation delay: T1 attempted resolution beyond scope
- Legal notification: not included in initial IR checklist
- Backup verification: no documented procedure
- External comms: no prepared holding statement

RECOMMENDATIONS:
1. Update IR playbook with mandatory legal notification at T2 escalation
2. Create backup verification runbook
3. Prepare template holding statements for common scenarios
4. Conduct monthly mini-TTX (30 min) on escalation decisions

NEXT EXERCISE: 2026-06-15 (supply chain compromise scenario)
```

## Workflow

1. **Design** — Select scenario type based on threat landscape
2. **Build** — Write injects with timing and expected responses
3. **Brief** — Set ground rules, roles, and objectives
4. **Execute** — Deliver injects, observe responses, take notes
5. **Debrief** — Hot wash immediately after exercise
6. **Report** — Write after-action report with findings
7. **Remediate** — Track gap closure via action items
8. **Repeat** — Schedule next exercise (quarterly minimum)

## Verification

| Check | Method |
|---|---|
| Scenario realistic and relevant | Threat intel alignment review |
| Injects properly timed | Facilitator guide walkthrough |
| Evaluation criteria defined | Rubric pre-approved by SOC lead |
| All roles represented | Participant roster confirmed |
| After-action items tracked | Issue tracker entries created |
