Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsSecurity Operations Tabletop Exercise Facilitator
Design, facilitate, and document professional security incident response tabletop exercises and after-action reports.
$15
security-operations-tabletop-exercise-facilitator
Example session with this skill installed
Design a three-hour ransomware security operations tabletop exercise for Tier 1 analysts, Tier 2 analysts, the SOC manager, IT operations, legal, communications, and executive stakeholders. Keep tooling generic and produce a facilitator guide, timed inject schedule, evaluation scorecard, and after-action report template.
- Read your context and instructions
- Compiled the security-operations-tabletop-exercise-facilitator
The skill produces an exercise planning brief confirming objectives, participants, and duration, a timed inject schedule with six escalating injects covering detection, triage, containment, executive briefing, communications, and recovery decisions, a facilitator guide with role-based discussion prompts and observer notes for each inject, an evaluation scorecard assessing process quality, decision making, escalation, communication, and documentation, and an after-action report structure separating strengths, gaps, risks, root causes, actions, owners, and validation points. All tooling references are marked as generic placeholders.
Connects securely to your tools. The creator never sees your data.
About this skill
High-Fidelity Security Tabletop Facilitation
This skill automates the complex process of designing, running, and documenting professional security operations tabletop exercises (TTX). Instead of spending days drafting scenarios and injects, developers and security leads can generate comprehensive exercise packages tailored to their specific stack and playbooks.
What it does
- Architects realistic multi-stage incident scenarios (Ransomware, BEC, Supply Chain, etc.).
- Generates timed "injects" with specific evidence artifacts (log snippets, alerts, tickets).
- Validates existing IR playbooks and cross-functional escalation workflows.
- Produces professional After Action Reports (AAR) with strength/gap analysis and remediation trackers.
Why use this skill
Prompting a generic AI often results in shallow, linear stories. This skill follows a rigorous evaluation framework, forcing participants to make hard decisions at each stage. It integrates context from your SIEM, EDR, and SOAR tools to create realistic technical hurdles while managing the non-technical aspects like legal, PR, and executive briefings. It ensures your IR drills are audit-ready and demonstrate measurable resilience improvement.
Supported Deliverables
- Exercise Plan: Strategy, scope, and objectives.
- Facilitator Guide: Detailed prompts, expected answers, and observer notes.
- Inject Schedule: A timeline of technical and business developments.
- Scorecard & AAR: Structured evaluation of team performance and gap identification.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
Trust & safety
Security scanned
Verified clean 4 months ago
- Passed all security checks, Safe to install