Detection Purple Tabletop Facilitation

---
name: detection-purple-tabletop-facilitation
description: "Scenario injects probing decision boundaries, revealing plan gaps without blame theater."
---
# Facilitate ransomware tabletops that find truth

> Scenario injects probing decision boundaries, revealing plan gaps without blame theater.

**Track:** 🛡️ Cyber Defense & SOC · **Domain:** Detection & Purple Team · **Level:** intermediate · **~40 min**

**Who this is for:** SOC Analysts, Detection Engineers, Threat Hunters, Blue Teams

## When to Use This Skill

Scenario injects probing decision boundaries, revealing plan gaps without blame theater.
Use it whenever a matching task appears in conversation — the agent loads these instructions on demand.

## Steps

1. Pick scenario targeting THIS org's crown jewels, not generic templates
2. Script escalating injects with decision points and time pressure
3. Assign roles including uncomfortable ones (legal, comms, CEO availability)
4. Capture decision log verbatim; gaps speak louder than slides
5. Debrief into ranked remediations with owners and deadlines
6. Retest failed injects in the next exercise cycle

## Common Pitfalls

- Scenarios so fictional everyone plays along harmlessly
- Action items dying between exercises year after year

## Commands

**Install with skills CLI**
```bash
npx skills add aniruddhaadak80/skills --skill detection-purple-tabletop-facilitation
```

**Install globally**
```bash
npx skills add aniruddhaadak80/skills --skill detection-purple-tabletop-facilitation -g
```

---

Part of [aniruddhaadak80/skills](https://github.com/aniruddhaadak80/skills) · Browse all at https://skills.sh/aniruddhaadak80/skills