c3.19 Run tabletop exercises
Train the blue team with tabletop exercises and simulations to confirm they can respond to incidents per your playbooks. Learning by doing builds the confidence and agility that a real incident demands.
Implementation guidance
Prepare before the tabletop
- Ensure responders know basic IR procedures (snapshot for evidence, disable IAM users, isolate EC2 instances).
- Have clear priorities defined (gather evidence vs. restore operations).
- Prepare your incident-response tooling in advance.
Run the exercise
Gather the response team in a "war room", then a facilitator narrates a scenario while the blue team explains — ideally demonstrates — the actions they would take. The facilitator iterates the story based on those actions, then reveals the end result, including threats that were missed. Cover your communications plan and escalation path, and any compliance or contractual notification obligations. Reality rarely follows the playbook exactly, so practice adapting to evasion and anti-forensics (for example an attacker tampering with SIEM integration so activity in a Region is not reported). Capture lessons learned and drive incremental improvement.
Ways to practice hands-on
- AWS Jam — gamified, capture-the-flag-style security challenges in temporary AWS accounts (available in paid Skill Builder or via training).
- AWS CloudSaga — a CLI tool that simulates documented AWS CIRT security events in your own sandbox (never in production).
- AWS Professional Services SIRS and AWS consulting partners can facilitate structured simulations for technical teams through to executives.
Reference
Ground your scenarios in the AWS Security Incident Response Guide and your own playbooks.
How to validate
- Do you run tabletop exercises and simulations for the blue team regularly?
- Are responders trained on basic IR actions (evidence capture, isolating instances, disabling identities)?
- Do exercises cover the communications and escalation plan, and feed lessons learned back into the playbooks?
Threats addressed
- A team that has never rehearsed responds slowly and inconsistently under the pressure of a real incident, giving an adversary more time and increasing the chance of incomplete eradication.
AWS services
AWS Security Incident Response