tabletopexerciselisted

# TabletopExercise Skill ## Purpose Design, facilitate, and evaluate cybersecurity tabletop exercises (TTX) for technical and executive audiences. Generate realistic scenarios, technical atomics for runners, and identify organizational gaps in incident response capabilities. ## When to Use - Designing tabletop exercise scenarios for SOC teams or executives - Creating technical "atomics" (executable injects) for scenario runners - Generating checklists to identify missing SOPs, playbooks, or procedures - Evaluating incident response plan effectiveness - Building cross-functional coordination exercises - Post-exercise gap analysis and improvement planning ## Key Capabilities ### 1. Scenario Generation - **Executive Scenarios**: Business impact focus, decision-making, communication strategies - **Technical Scenarios**: Detailed detection/response, forensics, technical challenges - **Hybrid Scenarios**: Cross-functional coordination exercises - **AI-Enhanced**: Deepfake attacks, automated threat chains, supply chain compromise ### 2. Technical Atomics for Runners Exercise facilitators receive **executable atomics** - specific technical actions to simulate during scenarios: **Example Atomic Set (Ransomware Scenario):** ``` T+0min: Send initial phishing email to participant's test inbox T+15min: Simulate EDR alert: "Suspicious PowerShell execution on DESKTOP-01" T+30min: Inject: Backup system shows "Replication failed - destination unreachable" T+45min: Deliver ransom note