Role Cards Reference for Incident Masters

This appendix provides a quick reference for all six incident response roles. Full role cards with gameplay guidance, example bonus actions, and badge alignment are in the Players Handbook individual role pages.

Complete Role Cards Overview

🔍 Detective (Cyber Sleuth)

See the full role card in the Players Handbook: Detective – Cyber Sleuth

🛡️ Protector (Digital Guardian)

See the full role card in the Players Handbook: Protector – Digital Guardian

📡 Tracker (Network Analyst)

See the full role card in the Players Handbook: Tracker – Network Analyst

📢 Communicator (Stakeholder Liaison)

See the full role card in the Players Handbook: Communicator – Stakeholder Liaison

⚡ Crisis Manager (Incident Commander)

See the full role card in the Players Handbook: Crisis Manager – Incident Commander

🎯 Threat Hunter (Proactive Defender)

See the full role card in the Players Handbook: Threat Hunter – Proactive Defender

IM Quick Reference: Role Strengths & Modifiers

Role Modifier Quick Reference Table

Role	+3 Bonus	+2 Bonus	+1 Bonus
🔍 Detective	Forensic Analysis	Pattern Recognition	Documentation
🛡️ Protector	Containment	Security Architecture	Business Continuity
📡 Tracker	Network Analysis	Data Tracking	Infrastructure Mapping
📢 Communicator	Stakeholder Management	Crisis Communication	Compliance
⚡ Crisis Manager	Coordination	Strategic Planning	Escalation Management
🎯 Threat Hunter	Threat Detection	Intelligence Analysis	Attack Prediction

Role Strengths at a Glance

• 🔍 Detective: Pattern recognition, evidence analysis, timeline construction
• 🛡️ Protector: Containment, security architecture, business continuity
  
• 📡 Tracker: Network analysis, data flow tracking, infrastructure mapping
• 📢 Communicator: Stakeholder management, crisis communication, compliance
• ⚡ Crisis Manager: Coordination, strategic planning, resource allocation
• 🎯 Threat Hunter: Advanced detection, intelligence analysis, attack prediction

Facilitation Tips by Role

Encouraging Balanced Participation

When Roles Dominate:

• Detective dominating: “Great analysis - how might other roles use this evidence?”
• Protector rushing: “What do other roles need to know before we contain?”
• Tracker getting technical: “How does this network data impact our response strategy?”
• Communicator over-managing: “What do the technical roles need to investigate first?”
• Crisis Manager micro-managing: “Let’s hear the specialist perspectives before coordinating.”
• Threat Hunter rabbit-holing: “What immediate threats need the team’s attention now?”

When Roles Withdraw:

• Detective quiet: “What patterns or anomalies stand out to you here?”
• Protector passive: “How would you protect our critical systems right now?”
• Tracker disconnected: “What network activity concerns you most?”
• Communicator silent: “Who needs to know about these developments?”
• Crisis Manager absent: “How should we prioritize these response activities?”
• Threat Hunter unfocused: “What aren’t we seeing that we should be looking for?”

Role-Specific Questions to Ask

🔍 Detective Activation:

• “What story do these clues tell you?”
• “What patterns does this remind you of?”
• “How would you build a timeline of this attack?”

🛡️ Protector Activation:

• “What’s your biggest security concern right now?”
• “How do we stop this from spreading?”
• “What systems need immediate protection?”

📡 Tracker Activation:

• “Where is this data going?”
• “What network activity looks suspicious?”
• “How is this threat moving through our systems?”

📢 Communicator Activation:

• “Who needs to know about this development?”
• “How would you explain this to executive leadership?”
• “What are the business implications?”

⚡ Crisis Manager Activation:

• “How should we prioritize these response activities?”
• “What resources do we need to coordinate?”
• “What’s our overall strategy here?”

🎯 Threat Hunter Activation:

• “What else might be hiding that we haven’t found?”
• “What would a sophisticated attacker do next?”
• “What intelligence can help us get ahead of this threat?”

Team Composition Guidelines

For 4-Player Teams

Essential Core:

• 🔍 Detective (investigation and analysis)
• 🛡️ Protector (containment and security)
• 📢 Communicator (stakeholder management)
• ⚡ Crisis Manager (coordination)

Alternative Configurations:

• Replace Crisis Manager with 📡 Tracker for network-heavy scenarios
• Replace Crisis Manager with 🎯 Threat Hunter for sophisticated threats

For 5-Player Teams

Recommended Additions:

• Core four + 📡 Tracker for network-focused incidents
• Core four + 🎯 Threat Hunter for APT scenarios
• Allow team to choose based on interests and scenario type

For 6-Player Teams

Full Coverage: All six roles provide maximum perspective diversity and comprehensive incident response coverage.

For Teams with Role Overlap

Managing Multiple Players in Same Role:

• Assign specialized focus areas (junior/senior, different systems)
• Create complementary responsibilities (analysis vs. communication)
• Use geographical or departmental divisions
• Emphasize different aspects of the role’s capabilities

This reference ensures IMs can quickly understand each role’s mechanical benefits, behavioral tendencies, and optimal activation strategies for balanced, engaging facilitation.