<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-incident-response-procedures
description: >-
  Validate incident response procedures through controlled purple team exercises.
  Covers tabletop simulation, live-fire IR drills, playbook validation, response
  time measurement, and gap identification across triage, containment, eradication,
  and recovery phases using Atomic Red Team and Caldera triggers.
domain: cybersecurity
subdomain: purple-team
tags:
  - incident-response
  - ir-testing
  - tabletop-exercise
  - playbook-validation
  - purple-team
  - response-time
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Testing Incident Response Procedures

## Overview

Testing IR procedures under controlled conditions validates that playbooks work in
practice, measures response times against SLAs, and identifies gaps before real
incidents expose them. Purple team IR testing combines red team stimulus with blue
team response measurement to produce actionable improvement data.

## Prerequisites

| Requirement | Install |
|---|---|
| Invoke-AtomicRedTeam | PowerShell module for generating IR triggers |
| MITRE Caldera | For automated multi-step attack simulation |
| Python 3.10+ | For agent tooling and metrics collection |
| Sigma CLI | `pip install sigma-cli` |
| curl / jq | For SIEM and ticketing API queries |

## Key Concepts

### IR Phase Measurement

| Phase | SLA Target | Measurement |
|---|---|---|
| Detection | < 5 min | Time from execution to SIEM alert |
| Triage | < 15 min | Time from alert to analyst assignment |
| Containment | < 1 hour | Time from triage to isolation action |
| Eradication | < 4 hours | Time from containment to threat removal |
| Recovery | < 24 hours | Time from eradication to service restoration |

### Exercise Scenario Template

```yaml
ir_exercise:
  name: "Ransomware Response Drill"
  type: live-fire  # tabletop | live-fire | hybrid
  scenario:
    threat: "Ransomware via phishing"
    attack_chain:
      - trigger: T1566.001  # Phishing
        inject_time: "T+0"
      - trigger: T1059.001  # PowerShell execution
        inject_time: "T+5m"
      - trigger: T1486      # Data encrypted for impact
        inject_time: "T+30m"
  expected_response:
    - phase: detection
      action: "SIEM alert fires for T1059.001"
      sla: 300  # seconds
    - phase: triage
      action: "SOC analyst acknowledges and classifies"
      sla: 900
    - phase: containment
      action: "Affected host isolated from network"
      sla: 3600
  success_criteria:
    - "All phases completed within SLA"
    - "Evidence preserved before eradication"
    - "Stakeholder notification within 30 minutes"
```

## Workflow

### 1. Design Exercise

```bash
# Create IR exercise scenario
node agent.js create-exercise \
  --name "Ransomware Response Drill" \
  --type live-fire \
  --techniques T1566.001 T1059.001 T1486 \
  --output exercises/ransomware_drill.yaml
```

### 2. Execute Attack Stimulus

```powershell
# Execute attack chain with delays between phases
Invoke-AtomicTest T1566.001 -TestNumbers 1
Start-Sleep -Seconds 300
Invoke-AtomicTest T1059.001 -TestNumbers 1
Start-Sleep -Seconds 1800
Invoke-AtomicTest T1486 -TestNumbers 1
```

### 3. Measure Response Times

```bash
# Track response metrics from SIEM and ticketing system
node agent.js measure-response \
  --exercise exercises/ransomware_drill.yaml \
  --siem-url https://splunk:8089 \
  --ticketing-url https://jira.internal/rest/api/2 \
  --output results/ransomware_drill_metrics.json
```

### 4. Evaluate Playbook Adherence

```bash
# Check if response actions matched playbook steps
node agent.js evaluate-playbook \
  --exercise exercises/ransomware_drill.yaml \
  --results results/ransomware_drill_metrics.json
```

### 5. Generate After-Action Report

```bash
# Produce AAR with findings and recommendations
node agent.js generate-aar \
  --exercise exercises/ransomware_drill.yaml \
  --results results/ransomware_drill_metrics.json \
  --output reports/ransomware_drill_aar.json
```

## Verification

| Check | Method |
|---|---|
| Attack stimulus executed | Atomic tests return exit code 0 |
| Detection triggered | SIEM alert within SLA window |
| Response measured | Timestamps captured for each IR phase |
| Playbook followed | Actions match expected response steps |
| AAR complete | Report includes gaps and recommendations |

## References

- [NIST SP 800-61 Rev. 2 — Incident Handling Guide](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [SANS Incident Handler's Handbook](https://www.sans.org/white-papers/33901/)
- [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team)
