Incident › Module 7 › Lesson 2
Tabletop Flow
Tabletop flow literacy — injects, decision points, role assignments, time compression — facilitator rows on YOUR `$IR_LAB` ransomware tabletop.
Visual · t34_tabletop_flow
Tabletop flow = named exercise rows. $IR_LAB. Original Cyberlium.
Opening
Tabletops train decisions under pressure — name inject sequence and role checkpoints on YOUR lab scenario before running unauthorized prod drills.
Tabletop flow literacy names: exercise objective category, participant roles (IR lead, comms, legal, exec literacy stubs), inject sequence (detection, containment call, ransom note, backup question literacy stubs), decision point rows with documented options, and hotwash/PIR preview category. Analyst drafts tabletop agenda on `$IR_LAB` ransomware scenario from 7-1 — three injects with decision prompts, role assignments, UTC milestones — without simulating real customer notification without authorization, without payment negotiation role-play scripts, without payload deploy for 'realism.' Cyberlium teaches facilitator vocabulary for defender exercises — YOUR labeled notes. Refused: unauthorized prod drill, payment crime how-tos, live victim data in injects. Lab row: tabletop agenda (objective, roles, three injects, decision points).
1. Named tabletop rows
Objective, roles, injects, decision points, hotwash preview — five literacy anchors.
Time compression noted — tabletop is training, not live incident.
Command guide
Try these commands — Named tabletop rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ransomware guide — https://www.cisa.gov/stopransomware/ransomware-guide NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/scenarios/tabletop-flow.md" <<'EOF'
# Ransomware Tabletop Flow — YOUR exercise
1. **Inject:** SOC alert — encryption on finance-lab-vm (fictional)
2. **Triage:** IR lead activates; severity Sev-1; intake form completed
3. **Contain:** decision-tree.md branch — segment isolation (tabletop decision)
4. **Comms:** internal status template; legal loop
5. **Eradicate/Recover:** backup restore plan; validation checklist
6. **PIR:** schedule within 14 days — see post-incident/pir-template.md
Duration: 90 min tabletop — no malware, no live prod changes
EOFCommand — copy this
grep -E 'Inject|Contain|PIR|no malware' "$IR_LAB/scenarios/tabletop-flow.md"
Primary tools to practice this lesson: grep, python3. Reference sites: CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Inject discipline
Each inject states facts vs assumptions — decision prompt lists defender options only.
Link Module 6 recovery and validation rows as inject outcomes.
3. Refused
No unauthorized prod customer notifications; no payment negotiation scripts.
Tabletop literacy supports team readiness — not crime rehearsal.
4. What you ship: tabletop agenda
Objective + roles + three injects + decision points + NEVER payment crime how-to line.
5. What you record before the next lesson
Tabletop agenda path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run unauthorized 'ransom payment negotiation' role-play with criminal contact scripts.
Right
Tabletop agenda from `$IR_LAB` ransomware scenario. Next: Payment Ethics.
Mission: tabletop agenda
1) Name five tabletop flow rows. 2) Three injects with decision prompts. 3) Role assignments per inject. 4) Write NEVER payment negotiation crime how-to line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Inject vs live incident — literacy boundary?”
Knowledge Check
APPLY: Tabletop flow literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Payment negotiation how-tos belong in tabletop prep.
True or False
Knowledge Check
APPLY: Tabletop agenda includes:
Multiple choice