tabletopexercise

name	TabletopExercise
description	Comprehensive cybersecurity tabletop exercise design and facilitation framework. USE WHEN designing incident response scenarios, creating executive or technical tabletops, generating atomics for exercise runners, identifying missing SOPs/playbooks, or evaluating organizational preparedness. Includes threat model integration, CISA-aligned methodologies, and automated gap analysis.

TabletopExercise Skill

Output Formats (ALWAYS GENERATE ALL THREE)

When you complete a tabletop exercise, generate these three outputs:

Output	Purpose	File
PDF	Professional client-ready document	[Exercise].pdf
Facilitator HTML	Full content with notes, answers, guidance	[Exercise]-facilitator.html
Participant HTML	Clean version, no spoilers for attendees	[Exercise]-participant.html

Generator Location

~/.openclaw/workspace/skills/TabletopExercise/generators/

Run with:

cd ~/.openclaw/workspace/skills/TabletopExercise/generators
bun run generate-html.ts --input ../examples/[slug]/exercise-data.json --output ../examples/[slug]/

Directory Structure

TabletopExercise/
├── SKILL.md                 # This file
├── ATOMICS-LIBRARY.md       # Atomic scenarios
├── generators/              # TypeScript generators
│   ├── generate-pdf.ts     # PDF generator
│   ├── generate-html.ts    # HTML generator
│   ├── generate-both.ts    # Generate both
│   └── package.json
├── templates/              # HTML templates
│   └── tabletop-exercise.html
├── examples/                # Example exercises
│   ├── lapsus-breach/
│   │   └── exercise-data.json
│   ├── ransomware-dev-network/
│   │   └── exercise-data.json
│   └── rainbow-six-ddos-attack/
│       └── exercise-data.json

Running the Generators

Prerequisites

cd ~/.openclaw/workspace/skills/TabletopExercise/generators
bun install

Generate HTML Files

cd generators
bun run generate-html.ts --input ../examples/[exercise]/exercise-data.json

Generate PDF

cd generators
bun run generate-pdf.ts --input ../examples/[exercise]/[exercise]-facilitator.html

Generate Both

cd generators
bun run generate-both.ts --exercise [exercise-name]

CRITICAL: Output Format Must Match Examples

The output MUST match the detail level and design of:

1. rainbow-six-ddos-attack-reference.html - Original detailed format
2. examples/ssrf-aws-compromise/ssrf-aws-facilitator-v2.html - Latest detailed format

Reference these files as templates. The SKILL.md below provides JSON structure, but always cross-reference with the HTML examples for exact styling and detail expectations.

Required JSON Structure (exercise-data.json)

Each exercise MUST have this structure:

{
  "title": "Exercise Title",
  "subtitle": "Brief description",
  "scenarioType": "Technical - Cloud Security",
  "targetAudience": "SOC Analysts, DevOps, Incident Response",
  "duration": "2 hours",
  "difficulty": "Intermediate",
  "severity": "CRITICAL",
  "preparedBy": "Arcanum Information Security",
  "date": "February 27, 2026",
  "version": "1.0",
  "executiveSummary": "2-3 paragraph detailed summary...",
  "scenarioOverview": "Detailed scenario narrative...",
  "attackVector": "Technical attack vector description",
  "potentialImpact": "Business and technical impact",
  "testingGoals": "What the exercise tests",
  "criticalGaps": "Gaps this exercise reveals",
  
  "facilitatorGuide": {
    "preparation": {
      "timeline": "When to prepare",
      "tasks": ["task 1", "task 2"],
      "materialsNeeded": ["item 1", "item 2"],
      "roomSetup": ["setup 1", "setup 2"]
    },
    "openingScript": "Full facilitator opening script...",
    "groundRules": ["rule 1", "rule 2"],
    "flowOverview": "How the exercise flows...",
    "timing": {
      "total": "2 hours",
      "breakdown": ["T+0: 20 min", "T+20: 15 min"]
    },
    "facilitation": [" facilitation note 1"],
    "closingScript": "Full closing script..."
  },

  "injects": [
    {
      "id": "UNIQUE-ID-001",
      "timing": "T+0",
      "title": "Inject Title",
      "priority": "high|critical",
      "scenario": "Full narrative scenario text (2-3 paragraphs)...",
      "artifact": {
        "type": "monitoring_alert|log|email|etc",
        "content": "Full artifact content with code blocks..."
      },
      "expectedResponse": "What the team should do...",
      "discussionQuestions": [
        "Question 1?",
        "Question 2?"
      ],
      "conditionalResponses": [
        {
          "condition": "If: What happens if X?",
          "response": "Response text..."
        }
      ],
      "facilitatorNotes": {
        "expectedTime": "15-20 minutes",
        "setup": "Setup and delivery instructions...",
        "keyPoints": ["Point 1", "Point 2"],
        "redFlags": ["Flag 1", "Flag 2"],
        "hints": ["Hint 1", "Hint 2"],
        "successIndicators": ["Indicator 1", "Indicator 2"]
      }
    }
  ],

  "objectives": [
    {
      "id": "OBJ-001",
      "title": "Objective Title",
      "description": "Detailed description",
      "type": "technical|process|communication"
    }
  ],

  "atomics": [
    {
      "id": "ATOMIC-001",
      "title": "Atomic Title",
      "description": "What the runner does",
      "execution": "Technical steps"
    }
  ],

  "gapAnalysis": [
    {
      "sop": "SOP/Playbook Name",
      "status": "exists|missing|partial",
      "gaps": ["Gap 1", "Gap 2"],
      "recommendations": ["Rec 1", "Rec 2"]
    }
  ]
}

Required HTML Sections (in order)

1. Hero Section: Title, subtitle, severity badge, metadata grid (type, duration, difficulty, date)
2. How to Run: Brief instructions
3. Executive Summary: 2-3 paragraphs
4. Scenario Overview: Detailed narrative
5. Attack Chain Timeline: Visual timeline of events
6. Exercise Objectives: List of objectives
7. Exercise Injects: Collapsible cards with full facilitator notes
8. Technical Atomics: For scenario runners
9. SOP/Playbook Gap Analysis: Gap cards
10. Action Items Summary: Table of findings

Inject Card Structure (EVERY inject must have)

<div class="collapsible-card">
  <div class="collapsible-header">
    <span class="collapsible-id">UNIQUE-ID-001</span>
    <span class="collapsible-time">T+0</span>
    <span class="collapsible-title">Title</span>
    <span class="priority-badge critical">critical</span>
  </div>
  <div class="collapsible-body">
    <div class="collapsible-content">
      <h4>Scenario</h4>
      <p>Narrative...</p>
      
      <h4>Artifact</h4>
      <div class="code-block"><pre>...</pre></div>
      
      <h4>Expected Response</h4>
      <p>...</p>
      
      <h4>Discussion Questions</h4>
      <ul><li>...</li></ul>
      
      <h4>Conditional Responses</h4>
      <div><strong>If:</strong> condition<br>response</div>
      
      <div class="facilitator-notes">
        <div class="facilitator-notes-header">🎯 FACILITATOR NOTES - CONFIDENTIAL</div>
        <div class="facilitator-subsection">
          <h5>⏱️ Expected Time</h5>
          <span class="time-badge">15-20 minutes</span>
        </div>
        <div class="facilitator-subsection">
          <h5>🎬 Setup & Delivery</h5>
          <p>Instructions...</p>
        </div>
        <div class="facilitator-subsection">
          <h5>🔑 Key Points to Emphasize</h5>
          <ul><li>...</li></ul>
        </div>
        <div class="facilitator-subsection">
          <h5>🚩 Red Flags to Watch For</h5>
          <ul><li>...</li></ul>
        </div>
        <div class="facilitator-subsection">
          <h5>💡 Hints If Team Gets Stuck</h5>
          <div class="hint-box">Hint text...</div>
        </div>
        <div class="facilitator-subsection">
          <h5>✅ Success Indicators</h5>
          <ul><li>...</li></ul>
        </div>
      </div>
    </div>
  </div>
</div>

CSS Requirements

• Use exact CSS from rainbow-six-ddos-attack-reference.html
• Primary color: #1e40af (blue)

MANDATORY Detail Requirements (NO EXCEPTIONS)

Every tabletop exercise output MUST include:

Inject Detail Requirements (MANDATORY)

Each inject MUST have:

1. Long scenario narrative (2-3 paragraphs minimum) - NOT one sentence
2. Detailed artifact - Realistic monitoring output/logs with emojis, metrics, timestamps
3. Expected response - Clear list of what team should do
4. Discussion questions (4-6 minimum)
5. Conditional responses (2-3 minimum) - "If: What happens if X?" scenarios
6. Full facilitator notes with:
   • Expected time (e.g., "15-20 minutes")
   • Setup & Delivery instructions
   • Key Points to Emphasize (bullet list)
   • Red Flags to Watch For (bullet list)
   • Hints If Team Gets Stuck (1-3 hints)
   • Success Indicators (bullet list)

Gap Analysis Detail Requirements (MANDATORY)

The gap analysis section MUST have:

1. Stat grid showing Critical/High/Medium/Low counts
2. Interactive eval forms for EACH gap with:
   • Priority badge (CRITICAL/HIGH/MEDIUM)
   • SOP/Playbook title
   • Evaluation Trigger description
   • Radio buttons: Adequate | Inadequate | Missing
   • Required Procedures list
   • Impact if Gap Remains (colored box)
   • Recommendation (colored box)
   • Action Items section with:
     • Assigned Owner (input field)
     • Due Date (date input)
     • Priority (dropdown)
     • Notes (textarea)

General Requirements

• Purple theme (#9333ea) for Arcanum
• Inter + JetBrains Mono fonts
• Collapsible inject cards with click handlers
• Timeline with connecting line
• Priority badges (critical=red, high=orange, medium=blue)
• Facilitator notes in yellow/gold background

No Shortcuts - FULL FIDELITY REQUIRED

• ❌ No simplified formats - match Rainbow Six exactly
• ❌ No missing inject sections
• ❌ No basic Q&A without full facilitator notes
• ❌ No gap analysis without interactive eval forms
• ❌ No short scenarios - needs paragraphs of detail
• ❌ No missing conditional responses
• ✅ FULL fidelity to Rainbow Six example (ssrf-aws-facilitator-v2.html)

Purpose

Design, facilitate, and evaluate cybersecurity tabletop exercises (TTX) for technical and executive audiences. Generate realistic scenarios, technical atomics for runners, and identify organizational gaps in incident response capabilities.

When to Use

• Designing tabletop exercise scenarios for SOC teams or executives
• Creating technical "atomics" (executable injects) for scenario runners
• Generating checklists to identify missing SOPs, playbooks, or procedures
• Evaluating incident response plan effectiveness
• Building cross-functional coordination exercises
• Post-exercise gap analysis and improvement planning

Key Capabilities

1. Scenario Generation

• Executive Scenarios: Business impact focus, decision-making, communication strategies
• Technical Scenarios: Detailed detection/response, forensics, technical challenges
• Hybrid Scenarios: Cross-functional coordination exercises
• AI-Enhanced: Deepfake attacks, automated threat chains, supply chain compromise

2. Technical Atomics for Runners

Exercise facilitators receive executable atomics - specific technical actions to simulate during scenarios:

Example Atomic Set (Ransomware Scenario):

T+0min: Send initial phishing email to participant's test inbox
T+15min: Simulate EDR alert: "Suspicious PowerShell execution on DESKTOP-01"
T+30min: Inject: Backup system shows "Replication failed - destination unreachable"
T+45min: Deliver ransom note via simulated file share
T+60min: Simulate CEO email inquiry: "Why can't I access the sales database?"

3. SOP/Playbook Gap Analysis

Automatically generates checklists identifying missing procedures:

Example Output:

MISSING PLAYBOOKS IDENTIFIED:
□ Ransomware Response Playbook
  - Detected mentions of: encryption, ransom, backup restoration
  - No documented procedure found for: crypto-ransomware containment

□ Executive Communication Protocol
  - Scenario requires CEO notification
  - Missing: Executive notification checklist, approval thresholds

□ Vendor Breach Response
  - Third-party compromise scenario element present
  - Missing: Vendor incident coordination runbook

4. Threat Model Integration

Scenarios built from real-world threat models:

• OAuth 2.0 attacks (RFC 6819)
• Kubernetes cluster compromise
• Supply chain attacks (npm, CDN)
• Cloud storage misconfiguration (AWS S3, GCS)
• IoT device exploitation
• AI/ML workload threats

5. CISA-Aligned Framework

Follows CISA Cybersecurity Tabletop Exercise Package (CTEP) methodology:

• 100+ pre-built scenario templates
• Facilitator guides and inject cards
• After-Action Report templates
• Objective-based performance analysis

Core Framework: Plan → Engage → Learn

Planning Phase

1. Define Objectives: 1-3 measurable goals (e.g., "Validate ransomware playbook")
2. Select Scenario: Match to organizational risk profile and threat landscape
3. Identify Participants: Cross-functional teams with actual decision authority
4. Prepare Materials: Scenario brief, injects, facilitator script, evaluation forms

Engaging Phase

1. Set Ground Rules: Psychological safety, low-pressure learning environment
2. Present Scenario: Realistic T0 (initial conditions)
3. Progressive Injects: Timed complications (ransom notes, backup failures, media inquiries)
4. Facilitate Discussion: Open-ended questions, cross-functional coordination
5. Document Observations: Real-time data collection by evaluators

Learning Phase

1. Hot Wash: 20-30 min immediate debrief
2. After-Action Report: Strengths, gaps, recommendations
3. Action Items: Assigned owners, deadlines, tracking
4. Implementation: Update IR plans, develop missing SOPs, schedule training
5. Follow-Up Exercise: Test improvements in 6-12 months

Scenario Types (Based on Threat Models)

1. Ransomware Attack

• Initial Vector: Phishing, RDP compromise, vulnerable service
• Progression: Lateral movement, backup encryption, ransom demand
• Key Decisions: Containment strategy, backup restoration, ransom payment consideration, law enforcement notification
• Atomics: EDR alerts, file encryption simulation, backup system failures, ransom note delivery

2. Business Email Compromise (BEC)

• Initial Vector: Executive account takeover (OAuth token theft, password spray)
• Progression: Fraudulent wire transfer request, financial approval bypass
• Key Decisions: Transaction verification, account suspension, fraud investigation
• Atomics: Spoofed email delivery, banking system access attempts, approval workflow bypass

3. Supply Chain Breach

• Initial Vector: Compromised vendor, malicious npm package, CDN compromise
• Progression: Backdoored dependencies, data exfiltration, customer impact
• Key Decisions: Vendor communication, customer notification, incident disclosure
• Atomics: Dependency scan alerts, network traffic to unknown IPs, customer data access logs

4. Kubernetes Cluster Compromise

• Initial Vector: Exposed API server, vulnerable container image, RBAC misconfiguration
• Progression: Container escape, privilege escalation, cryptomining deployment
• Key Decisions: Pod isolation, cluster rebuilding, service continuity
• Atomics: kubectl alerts, resource utilization spikes, container logs

5. Cloud Storage Misconfiguration

• Initial Vector: Public S3 bucket, misconfigured GCS permissions, leaked credentials
• Progression: Data discovery by attacker, exfiltration, public disclosure
• Key Decisions: Access revocation, data breach notification, regulatory reporting
• Atomics: CloudTrail anomalies, data access logs, security researcher notification

6. Deepfake Social Engineering (AI-Enhanced)

• Initial Vector: Deepfake CEO voice call, AI-generated phishing content
• Progression: Fraudulent authorization, sensitive data disclosure, financial fraud
• Key Decisions: Out-of-band verification protocols, AI detection strategies
• Atomics: Voice call simulation, urgent request for credentials/payments

7. Insider Threat

• Initial Vector: Disgruntled employee, compromised insider account, privilege abuse
• Progression: Data exfiltration, system sabotage, unauthorized access
• Key Decisions: Investigation protocols, legal coordination, termination procedures
• Atomics: DLP alerts, unusual data transfers, off-hours access logs

8. DDoS Attack

• Initial Vector: Botnet attack, amplification attack, application-layer DDoS
• Progression: Service degradation, customer impact, mitigation coordination
• Key Decisions: CDN activation, rate limiting, customer communication
• Atomics: Traffic spike simulation, service health dashboards, customer complaints

Technical vs Executive Audience

Executive Tabletop (Non-Technical)

Duration: 60-90 minutes Participants: C-suite, Board, Executive Directors, Business Unit heads Focus:

• Business impact and continuity decisions
• External communication and PR strategy
• Regulatory compliance and legal considerations
• Financial impact and insurance coordination
• Stakeholder management

Language: Non-technical, succinct, business-focused Outcomes: Improved alignment between leadership and technical teams, clarified executive roles during crises

Technical Tabletop (Operational)

Duration: 90-120 minutes Participants: SOC analysts, incident responders, IT Ops, Security Engineers Focus:

• Detection and containment procedures
• Forensic analysis and evidence collection
• Technical tool usage (SIEM, EDR, forensics platforms)
• System recovery and backup restoration
• Threat intelligence and IOC extraction

Language: Deep technical content, command-line operations, log analysis Outcomes: Validated technical playbooks, identified tool gaps, improved technical coordination

Atomics Generation Framework

When generating atomics for exercise runners, provide:

1. Pre-Exercise Setup Atomics

# Example: Ransomware scenario setup
# T-60min: Prepare test environment
- Create isolated test VM (VICTIM-01)
- Deploy test file share with sample data
- Configure email server for phishing simulation
- Prepare EDR console access for runner
- Stage ransom note template in runner directory

2. Timed Inject Atomics

## T+0 (Initial Compromise)
**Atomic ID**: PHISH-001
**Action**: Send phishing email to participant John Doe
**Email Template**: /exercises/ransomware-2024/templates/phish.eml
**Expected Response**: Participant reports email to security team within 15 minutes
**If No Response**: Proceed to T+15 inject regardless

## T+15 (EDR Alert)
**Atomic ID**: EDR-ALERT-001
**Action**: Display EDR alert on SOC dashboard
**Alert Details**:
  - Host: DESKTOP-01
  - User: jdoe
  - Process: powershell.exe -enc <base64>
  - Severity: HIGH
**Expected Response**: SOC analyst triages alert, escalates to IR team
**Facilitator Note**: If asked about base64 content, provide: "Downloads and executes secondary payload"

## T+30 (Backup Failure)
**Atomic ID**: BACKUP-FAIL-001
**Action**: Update backup system dashboard
**Status Change**: Replication status → "Failed - destination unreachable"
**Error Message**: "Cannot connect to backup-server-02.internal"
**Expected Response**: IT team investigates backup system, discovers encrypted files on backup target

3. Variable Response Atomics

## Conditional Inject: If Participants Ask to Check Logs
**Atomic ID**: LOG-RESPONSE-001
**Trigger**: Participant requests "Check firewall logs for outbound connections"
**Response**: Provide log excerpt showing:
  - Multiple connections to 203.0.113.42:8443 (C2 server)
  - Data exfiltration: 2.3 GB transferred over 4 hours
  - TLS encrypted traffic, no payload inspection available
**Facilitator Script**: "Your firewall logs show persistent connections to this IP over the last 4 hours. WHOIS shows it's registered in [Country]. What's your next step?"

4. Escalation Atomics

## T+60 (Executive Pressure)
**Atomic ID**: EXEC-EMAIL-001
**Action**: Simulate email from CEO to CTO (delivered via runner to participant)
**Subject**: "RE: Sales Database Access Issue - URGENT"
**Body**:
"I'm getting reports from the sales team that they can't access Salesforce. This is costing us deals. What's the status? Do we need to involve the board?"
**Expected Response**: CTO briefs CEO on incident status, provides estimated recovery timeline
**Facilitator Note**: If participants haven't identified ransomware yet, this pressure should accelerate investigation

5. Evidence Artifact Generation (OPTIONAL)

Generate realistic, detailed evidence artifacts that participants see during the tabletop. These make the exercise feel real and force participants to actually analyze evidence.

Evidence Types:

Type	Use Case
EDR alerts	JSON with process tree, file mods, network connections
SIEM dashboards	Splunk/Elastic query results
Email headers	Full BEC email with headers
Cloud logs	CloudTrail, GCP Audit Log, Azure Activity Log
Network logs	Zeek/suricata, firewall logs
Chat/Slack	Simulated IR channel messages
News articles	Fake breach disclosure
Ransom notes	Realistic text with demand
Dashboard screenshots	SOC wall display mockups

Format Examples:

// EDR Alert (Technical)
{
  "alert": {
    "id": "EDR-2026-48921",
    "rule": "Possible Ransomware Activity - Mass File Encryption",
    "severity": "CRITICAL",
    "timestamp": "2026-02-25T14:32:01Z",
    "host": "WIN-SRV-01.internal",
    "user": "svc_backup",
    "process_tree": [
      {"pid": 1234, "name": "explorer.exe", "parent": null},
      {"pid": 5678, "name": "cmd.exe", "parent": 1234},
      {"pid": 9012, "name": "powershell.exe", "parent": 5678, "cmd": "-enc JABjAGwA..."},
      {"pid": 3456, "name": "locked_files.exe", "parent": 9012}
    ],
    "files_encrypted": 1247,
    "first_file": "C:\\Finance\\Q1_Budget.xlsx",
    "network": {"outbound": ["185.141.xx.xx:443"]},
    "action_taken": "BLOCKED"
  }
}

// CloudTrail Log (Technical)
{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDACKCEVSQ6C2EXAMPLE",
    "arn": "arn:aws:iam::123456789012:user/admin",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-02-25T14:23:17Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "GetObject",
  "awsRegion": "us-east-1",
  "requestParameters": {
    "bucketName": "company-sensitive-data",
    "key": "customers/pii_export.csv"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.42",
  "errorCode": "AccessDenied",
  "errorMessage": "Access Denied"
}

// Email (BEC Scenario)
From: CEO <[e-mail]>
To: CFO <[e-mail]>
Subject: URGENT: Wire Transfer Needed
Date: Wed, 25 Feb 2026 14:45:00 -0500

Hi,

I need you to process an urgent wire transfer for our new vendor. 
This needs to go out TODAY before 5pm.

Bank: First National Bank
Account: 1234567890
Routing: 021000021
Amount: $47,500
Reference: Project Acquisition

I'm in meetings all day and can't call. Please confirm once sent.

Sent from my iPhone

Research Mode for Evidence:

For more realistic evidence, offer user a choice:

"Generate evidence at:
[A] Template level — Generic, faster
[B] Research-backed — I'll pull log formats from recent breaches for realism (~30s)
"

If [B], reference:
- Recent CVE announcements
- Known breach timelines
- Real vendor log schemas (CrowdStrike, SentinelOne, Splunk, AWS)

Design Principles:

• Evidence should match the scenario (ransomware = EDR alerts, BEC = emails)
• Technical audiences get JSON/logs; executives get summaries/dashboards
• Include enough detail for participants to actually analyze
• Make artifacts self-contained in the HTML (no external dependencies)

SOP/Playbook Gap Analysis Checklist Generator

The skill automatically generates gap analysis checklists by:

1. Scenario Decomposition: Identifies all decision points and required actions
2. Playbook Mapping: Checks for documented procedures covering each action
3. Gap Identification: Flags missing or inadequate procedures
4. Priority Scoring: Ranks gaps by criticality and likelihood

Example Gap Analysis Output

# SOP/Playbook Gap Analysis
**Scenario**: Ransomware Attack with Backup Failure
**Date**: 2026-02-06
**Participants**: SOC Team, IT Operations, Executive Leadership

---

## CRITICAL GAPS (Immediate Action Required)

### 1. Ransomware Containment Playbook - MISSING
**Scenario Trigger**: Multiple hosts showing file encryption behavior
**Required Decisions**:
  - [ ] Network segmentation procedures
  - [ ] Host isolation criteria and process
  - [ ] Active Directory credential reset procedures
  - [ ] Encrypted file preservation for forensics

**Impact if Missing**: Delayed containment, lateral spread to additional systems
**Recommendation**: Develop comprehensive ransomware response playbook covering:
  - Detection indicators (behavioral, file system, network)
  - Containment decision tree (isolate vs observe)
  - Credential rotation procedures
  - Backup verification and restoration process
  - Ransom payment decision framework (if organization policy allows consideration)

**Owner**: ___________ **Due Date**: ___________

---

### 2. Executive Communication During Active Incident - INADEQUATE
**Scenario Trigger**: CEO requests status update during ongoing incident
**Current Documentation**: Generic "incident notification template"
**Missing Elements**:
  - [ ] Executive briefing format and content requirements
  - [ ] Update frequency expectations during active incidents
  - [ ] Escalation thresholds requiring executive notification
  - [ ] Technical-to-business impact translation guide
  - [ ] Executive decision authority matrix (who approves what)

**Impact if Missing**: Inconsistent executive communication, business decision delays
**Recommendation**: Create executive incident communication playbook with:
  - Situation Report (SITREP) template
  - Update cadence by severity (Critical: hourly, High: every 4 hours)
  - Decision points requiring executive approval
  - Business impact assessment framework

**Owner**: ___________ **Due Date**: ___________

---

## HIGH-PRIORITY GAPS

### 3. Backup System Failure Response - PARTIAL
**Scenario Trigger**: Backup replication shows failed status
**Current Documentation**: IT runbook covers "routine backup monitoring"
**Missing Elements**:
  - [ ] Backup system compromise response procedures
  - [ ] Alternate backup verification methods (offline, immutable copies)
  - [ ] Backup restoration priority matrix (which systems first)
  - [ ] Backup integrity testing procedures

**Impact if Missing**: Extended recovery time, potential data loss
**Recommendation**: Enhance backup procedures with incident-specific guidance
**Owner**: ___________ **Due Date**: ___________

---

### 4. Third-Party Vendor Notification - MISSING
**Scenario Trigger**: Incident may impact vendor systems or data
**Required Decisions**:
  - [ ] When to notify vendors (timing, thresholds)
  - [ ] Who has authority to communicate with vendors
  - [ ] What information to share (technical details, IOCs)
  - [ ] Vendor incident coordination protocols

**Impact if Missing**: Contractual violations, delayed coordinated response
**Recommendation**: Develop vendor incident coordination framework
**Owner**: ___________ **Due Date**: ___________

---

## MEDIUM-PRIORITY GAPS

### 5. Forensic Evidence Collection - PARTIAL
**Scenario Trigger**: Need to preserve evidence for investigation/legal action
**Current Documentation**: "Incident handling basics" mentions "save logs"
**Missing Elements**:
  - [ ] Chain of custody procedures
  - [ ] Forensic image acquisition tools and methods
  - [ ] Evidence storage and retention policies
  - [ ] Legal hold procedures

**Impact if Missing**: Compromised evidence, inability to pursue legal action
**Recommendation**: Develop forensic evidence handling SOP
**Owner**: ___________ **Due Date**: ___________

---

## LOW-PRIORITY GAPS

### 6. Post-Incident Customer Communication - MISSING
**Scenario Trigger**: Ransomware impacts customer-facing services
**Missing Elements**:
  - [ ] Customer notification templates
  - [ ] Communication approval workflow
  - [ ] Regulatory notification requirements (GDPR, state breach laws)
  - [ ] Customer support escalation procedures

**Impact if Missing**: Regulatory non-compliance, customer trust damage
**Recommendation**: Create customer breach notification playbook
**Owner**: ___________ **Due Date**: ___________

---

## PROCESS GAPS

### Communication Channels
**Observed During Exercise**:
- Confusion about which Slack channel for incident coordination
- Some participants didn't have access to #incident-response
- Email used for time-sensitive updates (slow, unreliable)

**Recommendation**:
  - [ ] Establish dedicated incident communication platform
  - [ ] Pre-provision access for all IR team members
  - [ ] Document escalation procedures (when to page, when to email)
  - [ ] Test communication channels quarterly

---

## TOOL GAPS

### Detection and Response Tools
**Observed During Exercise**:
- EDR alerts not integrated with ticketing system (manual checking required)
- No automated host isolation capability (manual network changes)
- Backup monitoring dashboard not accessible to IR team

**Recommendation**:
  - [ ] Implement SOAR platform for automated response actions
  - [ ] Integrate EDR with ticketing/SIEM
  - [ ] Provide IR team access to backup monitoring
  - [ ] Evaluate automated network isolation tools

---

## TRAINING GAPS

### Identified Knowledge Deficiencies
- SOC analysts unfamiliar with ransomware behavioral indicators
- IT Ops unsure of backup restoration procedures under pressure
- Executives unclear on their roles during cyber incidents

**Recommendation**:
  - [ ] Ransomware detection training for SOC (quarterly)
  - [ ] Backup restoration drill for IT Ops (monthly)
  - [ ] Executive cyber crisis simulation (annually)

---

## SUMMARY METRICS

- **Total Gaps Identified**: 6 SOPs, 3 Process Issues, 3 Tool Gaps, 3 Training Needs
- **Critical Gaps**: 2
- **High-Priority Gaps**: 2
- **Estimated Remediation Effort**: 120 person-hours
- **Recommended Timeline**: 90 days for critical/high, 180 days for medium/low

---

## NEXT STEPS

1. **Immediate (Week 1)**:
   - Assign owners to all critical and high-priority gaps
   - Schedule working sessions to develop missing playbooks
   - Provision access to communication channels and tools

2. **Short-Term (Month 1-3)**:
   - Complete and test critical/high-priority SOPs
   - Implement recommended tool integrations
   - Conduct targeted training for identified knowledge gaps

3. **Follow-Up Exercise (Month 6)**:
   - Re-run similar ransomware scenario
   - Validate implemented improvements
   - Measure response time and coordination improvements

4. **Continuous Improvement**:
   - Quarterly review of all IR playbooks
   - Monthly mini-exercises (10-30 min rapid scenarios)
   - Annual comprehensive tabletop with executive participation

Best Practices (From Research)

Critical Success Factors

1. Clear Objectives: Define 1-3 measurable goals before designing scenario
2. Realistic Scenarios: Match organizational risk profile, avoid "doomsday" plots
3. Cross-Functional Participation: Include all departments involved in real incidents
4. Skilled Facilitation: Draw solutions from participants, don't provide answers
5. Psychological Safety: Frame as learning, not performance evaluation
6. Implement Findings: Assign owners, deadlines, track completion (most critical!)

Common Pitfalls to Avoid

❌ Not implementing lessons learned (exercise becomes useless) ❌ Unrealistic "movie-style hacking" scenarios ❌ Same participants every time (limit learning) ❌ Inadequate debriefing time (real learning happens here) ❌ Treating as performance evaluation (creates defensive behavior) ❌ Outdated contact lists (critical failure during real incidents)

Optimal Timing

• Duration: 60-90 minutes for quality discussion
• Frequency: Quarterly or monthly depending on risk profile
• Follow-Up: 6-12 months to test implemented improvements

Integration with PAI Security Tools

Caido MCP Integration

For scenarios involving web application compromise:

# Use Caido to demonstrate attack patterns during technical tabletops
/caido req.ext.eq:"php" AND req.query.matches:"eval|cmd"
# Show participants actual malicious requests from proxy history

Browser MCP Integration

For client-side attack scenarios (XSS, CSRF):

• Demonstrate exploit chains live during tabletop
• Capture screenshots/GIFs for scenario inject materials

JS Analyzer Integration

For supply chain compromise scenarios:

# Analyze compromised npm package during tabletop
bun run /root/doctorswzl/src/index.ts malicious-package.js
# Show participants dangerous sinks and data exfiltration code

Output Standards

All tabletop exercise deliverables include:

1. Executive Scenario Brief (1-2 pages)

   • Scenario overview, objectives, participant roles
   • Timeline and inject schedule
   • Expected outcomes

2. Facilitator Guide (5-10 pages)

   • Detailed scenario narrative
   • Timed inject cards with facilitator notes
   • Open-ended discussion questions
   • Expected responses and talking points

3. Technical Atomics Runbook (for runners)

   • Pre-exercise setup instructions
   • Timed atomic delivery schedule
   • Conditional response atomics
   • Troubleshooting guide

4. Evaluation Forms

   • Observer note sheets
   • Performance metrics tracking
   • Participant feedback forms

5. After-Action Report Template

   • Objectives assessment
   • What went well
   • Areas for improvement
   • Action items with owners and deadlines

6. SOP/Playbook Gap Analysis

   • Missing procedures identified
   • Priority rankings (Critical/High/Medium/Low)
   • Remediation recommendations
   • Implementation timeline

Two-File Output (Recommended)

CRITICAL: Always generate TWO separate HTML files:

1. Facilitator File (Full Access)

[Exercise-Name]-facilitator.html

Contains:

• Everything in the exercise
• All facilitator notes
• Expected responses
• Timing cues
• Discussion question answers
• Troubleshooting tips

2. Participant File (No Spoilers)

[Exercise-Name]-participant.html

Contains:

• Scenario overview
• Role/objectives
• Timeline (T+0, T+15, etc.) — WITHOUT facilitator notes
• Evidence artifacts
• Discussion questions — WITHOUT answers
• Any reference materials

Key principle: Participant file should not reveal:

• What the "correct" response is
• What's coming next in the timeline
• What facilitator should say
• Any hints about the scenario resolution

---

HTML Output Specification (REQUIRED)

The HTML report MUST have exactly these 9 sections in this order:

CSS Variables and Styling

:root {
    --primary: #1e40af;        /* Deep blue - headers, accents */
    --primary-dark: #1e3a8a;
    --primary-light: #3b82f6;
    --accent: #0ea5e9;         /* Sky blue - links, highlights */
    --danger: #dc2626;         /* Red - critical, severity */
    --warning: #f59e0b;         /* Amber - warnings */
    --success: #10b981;        /* Green - adequate, good */
    --info: #3b82f6;           /* Blue - informational */
    --gray-50: #f9fafb;
    --gray-100: #f3f4f6;
    --gray-200: #e5e7eb;
    --gray-300: #d1d5db;
    --gray-400: #9ca3af;
    --gray-500: #6b7280;
    --gray-600: #4b5563;
    --gray-700: #374151;
    --gray-800: #1f2937;
    --gray-900: #111827;
    font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
}

Section 1: Cover Page (Hero)

• Full-width gradient background (primary → primary-dark)
• Centered title (white, large, bold)
• Subtitle below title
• Metadata grid:
  • Scenario Type badge
  • Target Audience
  • Duration
  • Difficulty badge (color-coded: Critical=red, High=amber, Medium=blue, Low=gray)
  • Severity badge
  • Prepared By
  • Date
  • Version
• Company branding area

Section 2: Executive Summary

• Section header with number (e.g., "01")
• Executive summary paragraph (2-3 sentences)
• Attack Vector box (highlighted)
• Potential Impact box (highlighted)
• Testing Goals box
• Critical Gaps summary

Section 3: Scenario Overview

• Full narrative description of the scenario
• What the scenario tests
• Key decision points

Section 4: Objectives

• Numbered list (1-5 objectives)
• Each objective has:
  • Number badge
  • Title (bold)
  • Description
  • Success criteria list

Section 5: Timeline

• Visual timeline with events
• Each event has:
  • Time marker (T+0, T+15, etc.)
  • Title
  • Brief description
• Color-coded by severity

Section 6: Injects (COLLAPSIBLE CARDS)

CRITICAL - This is the core section

Each inject is a collapsible card with:

• Header row:
  • Inject ID (e.g., "DDOS-DETECT-001")
  • Time (T+0, T+15, etc.)
  • Title
  • Severity badge (color-coded)
  • Chevron icon (clickable)
• Collapsible body:
  • Scenario: Narrative description of what happens
  • Artifact: Code block with fake logs/alerts/emails/screenshots (MUST be detailed JSON/log format)
  • Expected Response: What participants should do/decided
  • Discussion Questions: List of questions to ask
  • Conditional Responses: (If trigger → Then response)
  • Facilitator Notes: Setup, delivery, expected time, key points, red flags, hints, success indicators, transition

Artifact Examples (MUST match these formats):

// EDR Alert
{
  "alert_id": "EDR-2026-48921",
  "rule": "Ransomware Activity - Mass File Encryption",
  "severity": "CRITICAL",
  "timestamp": "2026-02-25T14:32:01Z",
  "host": "WIN-SRV-01",
  "process_tree": [...],
  "files_encrypted": 1247,
  "network": {"outbound": ["185.141.xx.xx:443"]}
}

// Network Alert
MONITORING ALERT - HIGH SEVERITY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Alert: Network Traffic Anomaly
Time: 20:03:42 EST
Metrics:
  Inbound Traffic: 523 Gbps (normal: 45-60 Gbps)
  Source IPs: 12,000+

// Email
From: CEO <[e-mail]>
To: CFO <[e-mail]>
Subject: URGENT: Wire Transfer Needed

Section 7: Gap Analysis (Interactive Evaluation Forms)

• Stats grid: 4 cards showing count of Critical/High/Medium/Low gaps
• Each gap is an interactive form:
  • Priority badge (color-coded)
  • Gap title (bold)
  • Trigger (what scenario element exposed this gap)
  • Status radio buttons: Adequate | Inadequate | Missing
  • Required procedures checklist
  • Impact if gap remains
  • Recommendation textarea
  • Fillable fields: Owner, Due Date, Priority Adjustment, Notes

Section 8: Atomics (Technical Runbook)

• Table format
• Columns: ID, Time, Category, Action
• Each row is an atomic action for the runner

Section 9: Facilitator Guide (CONFIDENTIAL)

• Badge: "🎯 FACILITATOR GUIDE - CONFIDENTIAL"
• Subsections:
  • Pre-Exercise Preparation (tasks, timeline, materials, room setup)
  • Opening Script (full script text in styled box)
  • Ground Rules (numbered list)
  • Exercise Flow Overview (total duration, breakdown)
  • Facilitation Best Practices (numbered list)
  • Troubleshooting (issue → solution pairs)
  • Closing Script (full script text)

---

Two-File Output Implementation

Facilitator Version (FULL)

Contains ALL 9 sections with:

• All facilitator notes
• Expected responses
• All guidance

Participant Version (RESTRICTED)

Contains only:

• Cover page
• Executive Summary
• Scenario Overview
• Objectives
• Timeline
• Injects (Scenario + Artifact + Discussion Questions ONLY)
• Atomics

EXCLUDED from participant:

• Expected responses
• Facilitator notes
• Gap analysis forms
• All guidance sections

---

Interactive Features

The HTML MUST include:

1. Collapsible inject cards (click to expand/collapse)
2. Interactive gap analysis forms (radio buttons, text inputs)
3. Smooth scroll navigation
4. Print-friendly styles

---

Quality Requirements

• All artifacts MUST use realistic formats (JSON, logs, emails)
• Facilitator notes MUST include: setup, delivery, timing, key points, red flags, hints, success indicators, transition
• Gap analysis MUST have interactive evaluation forms with THIS EXACT FORMAT (see Rainbow Six example):
  • eval-form: Main container for each gap
  • eval-status: Radio button section (Adequate/Inadequate/Missing)
  • eval-details: Expandable details section
  • Required Procedures: Checklist of needed procedures
  • Impact if Gap Remains: Description box
  • Recommendation: Recommendation box
  • Action Items: Owner, Due Date, Adjusted Priority (dropdown), Notes (textarea)
  • FACILITATOR NOTES - CONFIDENTIAL: Probe questions and maturity indicators
• All sections MUST have numbered headers (01, 02, 03...)

Required Gap Analysis CSS Classes

The generator MUST include these CSS classes (see Rainbow Six for exact definitions):

.eval-form { background: var(--gray-50); padding: 1.5rem; border-radius: 0.5rem; margin-bottom: 1.5rem; }
.eval-status { display: flex; gap: 1rem; margin-bottom: 1.5rem; flex-wrap: wrap; }
.eval-option { flex: 1; min-width: 200px; }
.eval-option input[type="radio"] { margin-right: 0.5rem; }
.eval-option label { display: flex; align-items: center; padding: 1rem; border: 2px solid var(--gray-300); border-radius: 0.5rem; cursor: pointer; background: white; }
.eval-option input[type="radio"]:checked + label { border-color: var(--primary); background: #eff6ff; }
.eval-option.adequate input[type="radio"]:checked + label { border-color: var(--success); background: #f0fdf4; }
.eval-option.inadequate input[type="radio"]:checked + label { border-color: var(--warning); background: #fffbeb; }
.eval-option.missing input[type="radio"]:checked + label { border-color: var(--danger); background: #fef2f2; }
.eval-details { margin-top: 1.5rem; padding-top: 1.5rem; border-top: 2px solid var(--gray-200); }
.eval-field { margin-bottom: 1rem; }
.eval-field label { display: block; font-weight: 600; margin-bottom: 0.5rem; color: var(--gray-700); }
.eval-field input[type="text"], .eval-field input[type="date"], .eval-field textarea, .eval-field select { width: 100%; padding: 0.75rem; border: 1px solid var(--gray-300); border-radius: 0.375rem; font-family: inherit; }
.eval-field textarea { min-height: 80px; resize: vertical; }
.eval-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 1rem; }
.facilitator-notes { background: #fffbeb; border: 2px solid var(--warning); border-radius: 0.5rem; padding: 1.5rem; margin-top: 1.5rem; }
.facilitator-notes-header { display: flex; align-items: center; gap: 0.5rem; color: var(--warning); font-weight: 700; font-size: 0.875rem; text-transform: uppercase; margin-bottom: 1rem; padding-bottom: 0.75rem; border-bottom: 2px solid var(--warning); }

Gap Analysis Data Schema

Each gap MUST have this structure:

{
  "priority": "critical|high|medium|low",
  "title": "Gap Title",
  "trigger": "What in the scenario exposed this gap",
  "requiredProcedures": ["Procedure 1", "Procedure 2"],
  "impact": "What happens if this gap remains",
  "recommendation": "How to fix it",
  "probeQuestions": ["Question 1", "Question 2"],
  "maturityIndicators": {
    "adequate": "What adequate looks like",
    "inadequate": "What inadequate looks like", 
    "missing": "What missing looks like"
  }
}

Gap Analysis Section MUST appear in BOTH facilitator AND participant versions (the facilitator notes subsection is only in facilitator version).

How to Generate

When the skill creates the output, generate TWO files:

Output/
├── ransomware-scenario-facilitator.html    # Full access
└── ransomware-scenario-participant.html    # No spoilers

Visual distinction:

• Facilitator file: Add "FACILITATOR ONLY" banner at top
• Participant file: Add "PARTICIPANT COPY" banner

Usage Examples

Example 1: Generate Executive Ransomware Scenario

User: "Design an executive tabletop for ransomware with focus on business continuity decisions"

Skill Output:
- Executive-appropriate scenario brief
- Business impact focus (not technical details)
- Decision points: insurance, ransom payment, customer notification, board communication
- Inject cards: journalist inquiry, cyber insurance adjuster call, customer complaints
- No technical atomics (not relevant for executives)
- Gap analysis: executive communication procedures, crisis management plan

Example 2: Generate Technical Kubernetes Compromise Scenario with Atomics

User: "Create technical tabletop for Kubernetes cluster compromise with atomics for the runner"

Skill Output:
- Technical scenario brief with attack chain details
- Atomics runbook:
  * T+0: Display kubectl alert for unauthorized pod creation
  * T+15: Show container escape attempt in logs
  * T+30: Simulate cryptominer deployment (CPU spike)
  * T+45: Provide network logs showing C2 communication
- Facilitator guide with technical discussion questions
- Gap analysis: K8s incident response playbook, RBAC audit procedures, pod security policies

Example 3: Gap Analysis Only

User: "We just completed a BEC tabletop. Generate gap analysis for missing SOPs."

Skill Output:
- Comprehensive checklist of missing procedures
- Priority rankings based on scenario decisions
- Specific recommendations for each gap
- Owner assignment template
- Follow-up exercise recommendations

Resources

• CISA CTEPs: 100+ free scenario templates at cisa.gov/cybersecurity-tabletops
• NIST SP 800-84: Guide to Test, Training, and Exercise Programs
• After-Action Report Templates: CISA and NIST formats included
• Threat Models: OAuth, Kubernetes, cloud, IoT, AI/ML scenarios

---

File Organization and Output Structure

IMPORTANT: Each generated tabletop exercise is automatically organized into its own dedicated folder:

/root/.claude/skills/TabletopExercise/exercises/[exercise-slug]/
  ├── tabletop.md              # Full exercise documentation (Markdown)
  ├── exercise-data.json       # Structured JSON for PDF generation
  ├── [Exercise-Title].pdf     # Professional client-ready PDF
  └── README.md                # Exercise metadata and quick reference

Automatic Folder Creation Process:

1. Generate Slug: Convert exercise title to filesystem-safe slug

   • Example: "SSRF to AWS Credential Compromise" → "ssrf-aws-credential-compromise"

2. Create Exercise Folder: /root/.claude/skills/TabletopExercise/exercises/[slug]/

3. Save All Formats:

   • Markdown (tabletop.md): Complete exercise with all sections
   • JSON (exercise-data.json): Structured data for PDF regeneration
   • PDF: Professional, client-ready document with design
   • README.md: Quick reference with metadata and file descriptions

4. Confirm to User: Provide full path to exercise folder and PDF

File Purposes:

• tabletop.md: Complete exercise documentation, facilitator guide, inject cards
• exercise-data.json: Structured data matching PDF generator interface (preserves all content for future updates)
• PDF: Final deliverable for client presentation or executive review
• README.md: Exercise overview, scenario type, target audience, generation date

Regenerating PDFs:

If you need to update the PDF design or fix content:

cd /root/.claude/skills/TabletopExercise/pdf-generator
bun run generate-pdf.ts \
  --data ../exercises/[slug]/exercise-data.json \
  --output ../exercises/[slug]/Updated-Exercise.pdf

---

Version: 2.0 (Enhanced from original SOC Manager Table Top Designer) Enhancements:

• Added technical atomics generation for exercise runners
• Integrated SOP/playbook gap analysis framework
• Incorporated CISA CTEP methodology
• Added threat model-based scenario library
• Enhanced with 2025-2026 AI threat considerations
• Integrated PAI security tool workflows

Maintained by: Skylar (xssdoctor) Original: Arcanum-Sec redbluepurpleAI project