🛡️ Cyber Defense & SOC · Detection & Purple Team

Facilitate ransomware tabletops that find truth

Scenario injects probing decision boundaries, revealing plan gaps without blame theater.

intermediate~40 minSOC AnalystsDetection EngineersThreat Hunters

Steps

1Pick scenario targeting THIS org's crown jewels, not generic templates
2Script escalating injects with decision points and time pressure
3Assign roles including uncomfortable ones (legal, comms, CEO availability)
4Capture decision log verbatim; gaps speak louder than slides
5Debrief into ranked remediations with owners and deadlines
6Retest failed injects in the next exercise cycle

Common Pitfalls

▲Scenarios so fictional everyone plays along harmlessly
▲Action items dying between exercises year after year

Commands

Install with skills CLI

$ npx skills add aniruddhaadak80/skills --skill detection-purple-tabletop-facilitation

Install globally

$ npx skills add aniruddhaadak80/skills --skill detection-purple-tabletop-facilitation -g

Tags

#tabletop#incident-response#exercises#cyber-defense-ops#detection-purple

Install this skill

$ npx skills add aniruddhaadak80/skills --skill detection-purple-tabletop-facilitation -a opencode

SKILL.md

# Facilitate ransomware tabletops that find truth

> Scenario injects probing decision boundaries, revealing plan gaps without blame theater.

## When to Use This Skill

Scenario injects probing decision boundaries, revealing plan gaps without blame theater.

## Steps

1. Pick scenario targeting THIS org's crown jewels, not generic templates
2. Script escalating injects with decision points and time pressure
3. Assign roles including uncomfortable ones (legal, comms, CEO availability)
4. Capture decision log verbatim; gaps speak louder than slides
5. Debrief into ranked remediations with owners and deadlines
6. Retest failed injects in the next exercise cycle

## Common Pitfalls

- Scenarios so fictional everyone plays along harmlessly
- Action items dying between exercises year after year

View source on GitHub ↗

Ship detection rules like code: versioned, tested, tuned, and retired deliberately.

🛡️ Cyber Defense & SOC·~40m

Open →

Engineer detections through a full lifecycle (Microsoft Sentinel)advanced

Ship detection rules like code: versioned, tested, tuned, and retired deliberately.

🛡️ Cyber Defense & SOC·~40m

Open →

Validate detections with purple-team exercisesintermediate

Safe technique emulation proving alerts fire end-to-end, producing concrete coverage evidence.

🛡️ Cyber Defense & SOC·~40m

Open →