Role Cards Reference for Incident Masters
This appendix provides complete role cards for all six incident response roles. Use these during facilitation to understand each roleβs strengths, focus areas, modifiers, and roleplay guidance. These are identical to the cards in the Players Handbook for easy cross-reference.
Complete Role Cards Overview
π Detective (Cyber Sleuth)
Detective
π Archetype
πͺ Strengths
β’ Pattern Recognition: Spotting anomalies in logs and behavior
β’ Evidence Analysis: Connecting clues into attack timelines
β’ Digital Forensics: Understanding attack artifacts
β’ Timeline Construction: Building accurate chronologies
π― Focus Areas
β’ System logs and process executions
β’ Attack vector analysis and entry points
β’ Evidence preservation and IoC development
β’ Attack attribution and technique identification
πͺ Roleplay Tips
β’ Be curious about details others might skip
β’ Ask 'what does this remind you of?' when examining evidence
β’ Share your thought process: 'This pattern suggests...'
β’ Connect current findings to previous experiences
π² Game Modifiers
π‘οΈ Protector (Digital Guardian)
Protector
π Archetype
πͺ Strengths
β’ Security Architecture: Understanding defensive systems
β’ Threat Containment: Stopping attacks in progress
β’ Access Control: Managing permissions and restrictions
β’ Incident Isolation: Preventing spread of compromise
π― Focus Areas
β’ Network segmentation and isolation
β’ Security tool configuration and deployment
β’ Backup systems and recovery procedures
β’ Access control and privilege management
πͺ Roleplay Tips
β’ Think defensively: 'How do we stop this now?'
β’ Consider business continuity in every decision
β’ Be protective of critical assets
β’ Focus on immediate containment before analysis
π² Game Modifiers
π‘ Tracker (Network Analyst)
Tracker
π Archetype
πͺ Strengths
β’ Network Analysis: Understanding traffic patterns and flows
β’ Data Flow Tracking: Following information through systems
β’ Communication Monitoring: Detecting C2 and exfiltration
β’ Infrastructure Mapping: Understanding network relationships
π― Focus Areas
β’ Network traffic and communication patterns
β’ Data exfiltration and C2 channels
β’ Lateral movement detection
β’ Infrastructure and connection analysis
πͺ Roleplay Tips
β’ Think in terms of flows and connections
β’ Ask 'where is this data going?' and 'what is calling home?'
β’ Visualize the network in your explanations
β’ Focus on movement and communication patterns
π² Game Modifiers
π’ Communicator (Stakeholder Liaison)
Communicator
π Archetype
πͺ Strengths
β’ Stakeholder Management: Coordinating with leadership and teams
β’ Crisis Communication: Clear messaging during high-stress situations
β’ Regulatory Compliance: Understanding notification requirements
β’ Risk Translation: Explaining technical impacts in business terms
π― Focus Areas
β’ Executive and management communication
β’ User and employee notifications
β’ External vendor and partner coordination
β’ Regulatory and legal compliance communication
πͺ Roleplay Tips
β’ Always consider 'who needs to know?' about developments
β’ Translate technical details into business impact
β’ Think about timing and messaging of communications
β’ Balance transparency with operational security
π² Game Modifiers
β‘ Crisis Manager (Incident Commander)
Crisis Manager
π Archetype
πͺ Strengths
β’ Resource Allocation: Deploying people and tools effectively
β’ Priority Management: Deciding what's most important right now
β’ Team Coordination: Keeping everyone working toward common goals
β’ Decision Making: Making calls when information is incomplete
π― Focus Areas
β’ Response coordination and resource allocation
β’ Prioritization and decision making under pressure
β’ Escalation management and authority interfaces
β’ Overall incident strategy and planning
πͺ Roleplay Tips
β’ Think strategically about resource allocation
β’ Keep the big picture in mind during technical discussions
β’ Don't hesitate to make decisions with incomplete information
β’ Focus on coordination rather than doing everything yourself
π² Game Modifiers
π― Threat Hunter (Proactive Defender)
Threat Hunter
π Archetype
πͺ Strengths
β’ Advanced Detection: Finding sophisticated and hidden threats
β’ Attack Prediction: Anticipating threat behavior and evolution
β’ Intelligence Analysis: Using threat intelligence effectively
β’ Proactive Defense: Stopping attacks before they cause damage
π― Focus Areas
β’ Hidden threat detection and hunting
β’ Threat intelligence and attribution analysis
β’ Attack prediction and evolution assessment
β’ Advanced persistent threat investigation
πͺ Roleplay Tips
β’ Think beyond the immediate threat: 'What else might be here?'
β’ Use threat intelligence to predict attacker next moves
β’ Be proactive: look for what hasn't been found yet
β’ Consider the broader campaign beyond this incident
π² Game Modifiers
IM Quick Reference: Role Strengths & Modifiers
Role Modifier Quick Reference Table
| Role | +3 Bonus | +2 Bonus | +1 Bonus |
|---|---|---|---|
| π Detective | Forensic Analysis | Pattern Recognition | Documentation |
| π‘οΈ Protector | Containment | Security Architecture | Business Continuity |
| π‘ Tracker | Network Analysis | Data Tracking | Infrastructure Mapping |
| π’ Communicator | Stakeholder Management | Crisis Communication | Compliance |
| β‘ Crisis Manager | Coordination | Strategic Planning | Escalation Management |
| π― Threat Hunter | Threat Detection | Intelligence Analysis | Attack Prediction |
Role Strengths at a Glance
- π Detective: Pattern recognition, evidence analysis, timeline construction
- π‘οΈ Protector: Containment, security architecture, business continuity
- π‘ Tracker: Network analysis, data flow tracking, infrastructure mapping
- π’ Communicator: Stakeholder management, crisis communication, compliance
- β‘ Crisis Manager: Coordination, strategic planning, resource allocation
- π― Threat Hunter: Advanced detection, intelligence analysis, attack prediction
Facilitation Tips by Role
Encouraging Balanced Participation
When Roles Dominate:
- Detective dominating: βGreat analysis - how might other roles use this evidence?β
- Protector rushing: βWhat do other roles need to know before we contain?β
- Tracker getting technical: βHow does this network data impact our response strategy?β
- Communicator over-managing: βWhat do the technical roles need to investigate first?β
- Crisis Manager micro-managing: βLetβs hear the specialist perspectives before coordinating.β
- Threat Hunter rabbit-holing: βWhat immediate threats need the teamβs attention now?β
When Roles Withdraw:
- Detective quiet: βWhat patterns or anomalies stand out to you here?β
- Protector passive: βHow would you protect our critical systems right now?β
- Tracker disconnected: βWhat network activity concerns you most?β
- Communicator silent: βWho needs to know about these developments?β
- Crisis Manager absent: βHow should we prioritize these response activities?β
- Threat Hunter unfocused: βWhat arenβt we seeing that we should be looking for?β
Role-Specific Questions to Ask
π Detective Activation:
- βWhat story do these clues tell you?β
- βWhat patterns does this remind you of?β
- βHow would you build a timeline of this attack?β
π‘οΈ Protector Activation:
- βWhatβs your biggest security concern right now?β
- βHow do we stop this from spreading?β
- βWhat systems need immediate protection?β
π‘ Tracker Activation:
- βWhere is this data going?β
- βWhat network activity looks suspicious?β
- βHow is this threat moving through our systems?β
π’ Communicator Activation:
- βWho needs to know about this development?β
- βHow would you explain this to executive leadership?β
- βWhat are the business implications?β
β‘ Crisis Manager Activation:
- βHow should we prioritize these response activities?β
- βWhat resources do we need to coordinate?β
- βWhatβs our overall strategy here?β
π― Threat Hunter Activation:
- βWhat else might be hiding that we havenβt found?β
- βWhat would a sophisticated attacker do next?β
- βWhat intelligence can help us get ahead of this threat?β
Team Composition Guidelines
For 4-Player Teams
Essential Core:
- π Detective (investigation and analysis)
- π‘οΈ Protector (containment and security)
- π’ Communicator (stakeholder management)
- β‘ Crisis Manager (coordination)
Alternative Configurations:
- Replace Crisis Manager with π‘ Tracker for network-heavy scenarios
- Replace Crisis Manager with π― Threat Hunter for sophisticated threats
For 5-Player Teams
Recommended Additions:
- Core four + π‘ Tracker for network-focused incidents
- Core four + π― Threat Hunter for APT scenarios
- Allow team to choose based on interests and scenario type
For 6-Player Teams
Full Coverage: All six roles provide maximum perspective diversity and comprehensive incident response coverage.
For Teams with Role Overlap
Managing Multiple Players in Same Role:
- Assign specialized focus areas (junior/senior, different systems)
- Create complementary responsibilities (analysis vs. communication)
- Use geographical or departmental divisions
- Emphasize different aspects of the roleβs capabilities
This reference ensures IMs can quickly understand each roleβs mechanical benefits, behavioral tendencies, and optimal activation strategies for balanced, engaging facilitation.