Response playbooks and tabletop exercises
You write step-by-step playbooks for phishing, ransomware and account takeover, test them in tabletop exercises and track team readiness with measurable metrics.
Level 301 · 15 lessons · 12 practice labs
Lessons
Writing playbooks
- Anatomy of a playbook: trigger, roles, steps, decision points
- The severity matrix and escalation rules
- Who does what with RACI: technical, legal, communications, management
- Short task: write a one-page playbook for a lost laptop
Scenario playbooks
- The phishing playbook: from report to mailbox clean-up
- The account-takeover playbook: killing sessions and reclaiming identity
- The ransomware playbook: the first 60 minutes
- The data-breach playbook: scope, personal data and notification
- The insider-threat playbook: a quiet investigation with HR and legal
- Short task: break a playbook into automatable steps
Exercises and measurement
- Designing a tabletop: scenario, injects, observers
- Running the exercise and keeping decision logs
- The after-action report and improvement list
- Response metrics: time to detect, contain and recover
- Capstone: prepare, run and report a tabletop for a fictional company
Practice labs
- Know the parts of a playbook: Mark the trigger, roles, steps and decision points in a ready-made playbook.
- A one-page playbook for a lost laptop: Write a one-page playbook for a lost laptop with trigger, steps and decision points.
- Build a severity matrix and RACI: Prepare the escalation rule for four severity levels and the RACI table for technical, legal, communications and management roles.
- Order the steps of the phishing playbook: Put ten steps from the report to mailbox clean-up in the right order.
- Write an account takeover playbook: Write a playbook with session revocation, identity recovery and verification steps.
- The notification decision in a data breach playbook: Draw a decision tree giving the notification decision by scope, personal data type and country.
- Split a playbook into automatable steps: Separate a playbook's steps into human decision and automatable.
- Ransomware playbook: the first 60 minutes: Plan the first 60 minutes in fifteen-minute slots with action and owner.
- A quiet investigation playbook for insider threat: Write a playbook run together with HR and legal that protects confidentiality and defines the evidence steps.
- Calculate the response metrics: Calculate detection, containment and recovery times from the records of three past incidents.
- Design a tabletop exercise: Design a one-hour exercise with a scenario, five injects and an observer form.
- An after-action report and improvement list: From the prepared decision log of the Lodoskaya Denizcilik exercise, write the strengths, gaps and an improvement list with owners.
About this course
You write step-by-step playbooks for phishing, ransomware and account takeover, test them in tabletop exercises and track team readiness with measurable metrics.
What you will learn
- Writing playbooks
- Scenario playbooks
- Exercises and measurement
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.