Facilitator Debrief Tracker

Fill in during the game. Use during debrief to reference specific moments and decisions.

Containment Decisions

Action	Owner (team/person)	Time	Rolled?	Result
Credential revocation (svc-rdbridge-admin)
Exception closure (COLLBRIDGE-EXCL-003)
Memory image preservation
C2 perimeter block (203.0.113.44)
GenixLibrary isolation
HANSEN-SAP-01 isolation
Vendor notification (CaliSync)
CFCS artifact handoff

Threat Clock

Card	Fired / Skipped	Time	Notes
T1 – Cloud access persists
T2 – Subnet exception exposed
T3 – Anti-forensics
T4 – Exfil spike
T5 – Final outcome

Team Observations

Alpha (Forensics):

• Identified EDR gap on HANSEN-SAP-01
• Requested memory scan
• Connected CaliSync cert to supply chain
• Noticed targeting specificity (file types)

Bravo (Network):

• Identified NTLM/Kerberos anomaly
• Connected CA exception to attack path
• Identified two-step containment need
• Traced DLP gaps

Charlie (TI & Recovery):

• Correlated CFCS indicators with findings
• Identified UTC+8 operational tempo
• Briefed Victim A recovery lessons
• Produced attribution synthesis

IC Performance

IC #1 (Rounds 1-2):

• Maintained whiteboard
• Synthesized across teams (not just listened)
• Made containment decisions with owners
• Completed SBAR handover

IC #2 (Rounds 3-4):

• Asked clarifying questions at handover
• Verified whiteboard status
• Responded to new escalations
• Owned closing decisions

Handover quality:

Time IC #2 said “I have command”: ________

What IC #2 said they didn’t know:

 

Moments for Debrief

Quotes, decisions, turning points — your ammunition for the debrief.

 

 

NPC Triggers Played

NPC	Played?	When
CEO (Phillip)
CTO (Katrine)
CISO (Bent)
VP R&D (Ida)
CFCS Liaison