sysop@hub:~/explainers/incident-sim$

incident-sim

A tabletop exercise you can run alone, in ten minutes. The alerts come in, you decide, the clock moves, and what you did not do comes back later. At the end every decision is debriefed. Nothing here is a trick question: each option is something real admins do under pressure.

choose a scenario

how to use this with a team

Put it on a screen, read each situation aloud, and make people commit to an answer before anyone clicks. The disagreements are the exercise. Afterwards ask the one question that matters: could we actually have done the best option here, tonight, with our access and our phone list?

The scenarios are composites of common real incidents, simplified so they fit ten minutes. Company, people and figures are invented. Real incidents are messier: evidence is ambiguous, tools fail, and the right order depends on your environment. The scoring reflects widely shared incident response practice, not a formal standard, and reasonable responders will argue with some of it. That argument is welcome.