Machine View & Defense · Planning only · no live incident action

Machine Tradecraft Tabletop Exercise & Runbook Lab

The laboratory turns one of eight governed fictional scenarios into a staged, request-local exercise and deterministic runbook. It never scores readiness, declares pass or failure, stores the record, or authorizes an operational action.

Browse all labs Open universal Machine View

Quick answer

What does the Tabletop Exercise & Runbook show?

Human visibility: Fictional staged incident record
Machine receiver: Human exercise team and deterministic local runbook builder
Robustness: Stable for the same release and selections

Research boundary: this page uses bounded, inert data and fixed safe examples. It never executes decoded content, requests secrets, calls third-party services, or performs actions against external systems.

Review the prepared starter input
A bounded benign input is already present. Change it only when you are ready to test a different authorized artifact.
Run Build JSON exercise record
Run the normal first-pass analysis for the prepared values above.
Scan before expanding
Compare the before/after evidence, then read the defensive qualification before generalizing.

INPUT / CONTROL PLANE

Prepare the input and choose one action.

Ready

The recommended first run is separated from alternate analyses. Inputs and selected files stay on this host.

Current input state Prepared starter input loaded

The form is prefilled with a bounded safe starting point. Nothing runs until you choose an action.

Fictional exercise scenario

Choose one of the eight governed fictional scenarios. The exercise never accepts an unrestricted incident narrative.

Participating role IDs 73 / 320 bytes

Enter two to eight comma-separated role IDs: executive-owner, engineering, security-operations, ai-model-operations, content-data-owner, privacy-legal, incident-commander, independent-observer.

Maximum: 320 UTF-8 bytes.

Reveal through stage

Only the selected number of injects becomes part of the generated exercise record. JavaScript progressively hides later decision fields; the no-JavaScript form remains fully usable.

Stage 1 decision category

Classify the decision as preserve, inspect, contain, verify, authorize, recover, or defer. The category is descriptive and is not a score.

Stage 1 decision note 128 / 900 bytes

Maximum 900 UTF-8 bytes and 480 visible characters. Enter a short fictional exercise decision only; do not enter live incident data, secrets, personal data, or production instructions.

Maximum: 900 UTF-8 bytes.

Stage 2 decision category

Classify the decision as preserve, inspect, contain, verify, authorize, recover, or defer. The category is descriptive and is not a score.

Stage 2 decision note 121 / 900 bytes

Maximum 900 UTF-8 bytes and 480 visible characters. Enter a short fictional exercise decision only; do not enter live incident data, secrets, personal data, or production instructions.

Maximum: 900 UTF-8 bytes.

Stage 3 decision category

Classify the decision as preserve, inspect, contain, verify, authorize, recover, or defer. The category is descriptive and is not a score.

Stage 3 decision note 125 / 900 bytes

Maximum 900 UTF-8 bytes and 480 visible characters. Enter a short fictional exercise decision only; do not enter live incident data, secrets, personal data, or production instructions.

Maximum: 900 UTF-8 bytes.

Stage 4 decision category

Classify the decision as preserve, inspect, contain, verify, authorize, recover, or defer. The category is descriptive and is not a score.

Stage 4 decision note 122 / 900 bytes

Maximum 900 UTF-8 bytes and 480 visible characters. Enter a short fictional exercise decision only; do not enter live incident data, secrets, personal data, or production instructions.

Maximum: 900 UTF-8 bytes.

Containment note 182 / 1,200 bytes

Optional bounded exercise note describing capability isolation, evidence preservation, or temporary operational boundaries.

Maximum: 1,200 UTF-8 bytes.

Recovery note 156 / 1,200 bytes

Optional bounded exercise note describing a known-good replay and validation sequence. It does not authorize production recovery.

Maximum: 1,200 UTF-8 bytes.

Lessons-learned note 154 / 1,200 bytes

Optional bounded exercise reflection. The tool does not grade the team or declare readiness.

Maximum: 1,200 UTF-8 bytes.

Additional unanswered question 103 / 1,200 bytes

Optional question that remains open after the local exercise. Use it to name a verification gap rather than to speculate about intent.

Maximum: 1,200 UTF-8 bytes.

Switch prepared example3 options

Loading a sample changes only the form values. Review the result and run an action yourself.

Prepared benign examples

ACTION HIERARCHY

Run the recommended first pass.

Alternate actions remain available below, but the first pass is the clearest place to start.

Other analyses1 action

JavaScript is optional. Submitting this form reloads the page, runs the same bounded local PHP analysis, and moves to the output region. Prepared-example buttons are enhancement-only; the starter values above remain directly editable.

Inputs remain on this host. Text operations are size-limited; uploaded files are processed from PHP’s temporary upload and are not retained by the application.

OUTPUT / MACHINE VIEWS

Scan the result from summary to evidence.

Run Build JSON exercise record to create the first result.

The prepared starter input is ready. The output will lead with a summary and visible qualifications before the expandable machine views.

SummaryFindingsMachine views

Interpretation framework

The same artifact can produce several valid observations.

Human view

What a person naturally reads, sees, or hears.

Structural view

What a parser, DOM, container reader, or metadata extractor exposes.

Decoder view

What becomes meaningful only with a rule, key, tokenizer, model, or tool.

Defensive view

What normalization, rendering, OCR, canonicalization, or policy changes.

Evidence and decision boundary

Use the result as bounded evidence, not as a universal verdict.

Interpretation rule

Record the receiver and transformation.

Machine-decodable is receiver-relative. Record the parser, preprocessing, codebook, tokenizer, key, model, and transformation path before generalizing from one result.

Limitations

What this page does not prove

The exercise is fictional and request-local. It does not score participants, establish readiness, infer malicious intent, verify a production environment, authorize containment or recovery, or create an incident record.

Search guides, labs, glossary, and research

Start with a channel, artifact, or defense term

Machine Tradecraft Tabletop Exercise & Runbook Lab

What does the Tabletop Exercise & Runbook show?

Start with the prepared, bounded workflow.

Prepare the input and choose one action.

Run the recommended first pass.

Scan the result from summary to evidence.

Run Build JSON exercise record to create the first result.

Summary

Action and input provenance

What changed on this rerun

At-a-glance metrics

Findings and qualifications

Machine and structural views

Structured rows

Generated safe fixture

Run complete

The same artifact can produce several valid observations.

Human view

Structural view

Decoder view

Defensive view

Use the result as bounded evidence, not as a universal verdict.

Record the receiver and transformation.

What this page does not prove

What does the Tabletop Exercise & Runbook show?

Run Build JSON exercise record to create the first result.

The same artifact can produce several valid observations.

Human view

Structural view

Decoder view

Defensive view

Use the result as bounded evidence, not as a universal verdict.

Record the receiver and transformation.

What this page does not prove

Related labs and source reports

Choose the next useful view.