Incident desk

A solo incident-response tabletop

You have the incident.

Ten organisations. One pattern behind them. Your call.

An intruder has worked through four stages somewhere in the organisation. Each turn you state what you think happened, test it against one evidence source and decide what to do with what you find. Once the whole chain is known, you lead the response.

  1. 1EntryHow they got in
  2. 2MovementWhere they went, and as whom
  3. 3FootholdHow they stay
  4. 4OutboundWhat leaves, and how
Operational, Maya Chen, or choose the assignment below
Your command recordInvestigation Lead0/10 incidents, trust 50, readiness 50
What trust and readiness doTrust 50: no effect yet; at 75 it takes 3 off starting impact, below 35 it costs a map action. Readiness 50: no effect yet; at 60 it adds 3 service at the start, at 75 a turn.
Experience 0
Act 1
First contact

Establish the pattern behind a series of apparently isolated compromises.

Director: Three organisations have reported intrusions this month that look unrelated. Take each one on its own evidence and tell me whether they are.

0 unresolved access
Campaign route: Common GroundCoordinate partners and protect shared operational confidence.

Specialists recover faster and leadership trust matters more.

Form BC-001 / Assignment
Case
1 of 10
Sector
Enterprise IT
Status
Open

The quiet intrusion

Two staff report odd behaviour on their computers, and a routine check finds traffic leaving that nobody expected.

Mastery ladder, 0 of 5. Next: win the case at Crisis difficulty.

Difficulty

Balanced uncertainty, pressure and time.

Specialist on callFatigue carries between campaign operations; a rested specialist recovers faster than one on duty. At 5 of 6 the specialist's +1 on their own sources no longer applies.

Maya Chen / TRACE, Threat hunter, Cross-source behaviour, fatigue 0 of 6. +1 when using hunting, network or intelligence evidence. Rapport with Maya Chen 35 of 100: it grows with each operation together, and the team's average shapes how the campaign ends.

Advanced operation settings Campaign
Operation mode

Campaign standing — leadership trust, readiness, unresolved access and the route — shapes this operation, and its result counts toward the campaign.

Scenario code
Preparing code

A code reproduces the incident, its variant and its dice. Daily operation plays today’s code and Weekly operation this week’s; an ordinary campaign operation draws a fresh incident unless you load a code or generate a seed, which applies to the next operation you begin. Campaign standing is not part of a code, so two commands at different seniority will see different modifiers from the same code.

Strategic prompts, never the correct card.
Resolve routine actions inline after the tutorial.
Watch a local rule-based operator play. Practice runs do not save or award campaign progress.
20–35 minutes soloNo real systems

Breach Command. A solo tabletop of four-stage intrusions, played against a rule-based Incident Captain. Every organisation, person and breach in it is invented. Version 0.9.65, build a088dfc.