Save MSEL
Save the MSEL as a whole.
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”PUT /ttx/{ttx_id}/msel – the whole MSEL in one save, like the needs
form: a DRAFT may be incomplete (the validation report judges it), only
what can never be stored is rejected (unknown references, limits), and
collections are full-replace keyed by id. revision is the one the
client edited (optimistic locking).
object
A simulated actor. id is set for a saved row; key is how injects
in the same payload refer to it – the id itself for a saved row, any
temporary string for a new one (same scheme as the needs form).
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
object
An inject’s content rendered as a simulated artifact. The body is the
inject’s own content; these are the template’s other fields, whose
meaning follows kind (email: from, address, to, subject, date; press
release: outlet, dateline, headline, date; social post: author, handle,
date; chat message: sender, channel, date). All plain text: the
Playground draws them, nothing is ever rendered as markup.
object
How the Playground renders an inject’s content as a simulated artifact (a template drawn by the app, never uploaded markup).
Whose activity an inject’s ATT&CK techniques are: a threat actor of the scenario’s, or noise – unrelated activity (other attackers, commodity malware, coincidences, false positives) that tests the players’ triage. None (the column null): no ATT&CK at all.
An ATT&CK technique under the tactic it serves, by id. Whether it exists is checked against the MSEL’s pinned release by the service (the payload doesn’t carry the release).
object
An uploaded file of the MSEL handed out with the inject (in order).
object
What an inject is, and so what it asks of the table: an inject that evaluates objectives (INJ), a discussion slide – a debrief or reflection prompt, no objective, not in the EEG nor the coverage (DSC) –, or a poll the Players vote on, outside the evaluation too (POL).
An uploaded image of the MSEL shown with the inject (in order).
object
object
An impact meter: what the polls’ decisions add up on.
object
object
A threat actor of the scenario (see MselThreatActor). key is how
injects in the same payload attribute to it (the id for a saved row).
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
A technique a threat actor uses, as MITRE records it: no tactic (a technique may serve several).
object
Responses
Section titled “Responses”Successful Response
object
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
With its names in the pinned release (English, as MITRE publishes them) – kept in snapshots, so a frozen MSEL reads on its own.
object
A version of the MSEL frozen when it became READY, and the sessions played from it.
object
object
An inject’s content rendered as a simulated artifact. The body is the
inject’s own content; these are the template’s other fields, whose
meaning follows kind (email: from, address, to, subject, date; press
release: outlet, dateline, headline, date; social post: author, handle,
date; chat message: sender, channel, date). All plain text: the
Playground draws them, nothing is ever rendered as markup.
object
How the Playground renders an inject’s content as a simulated artifact (a template drawn by the app, never uploaded markup).
Whose activity an inject’s ATT&CK techniques are: a threat actor of the scenario’s, or noise – unrelated activity (other attackers, commodity malware, coincidences, false positives) that tests the players’ triage. None (the column null): no ATT&CK at all.
With its names in the pinned release (English, as MITRE publishes them) – kept in snapshots, so a frozen MSEL reads on its own.
object
object
object
What an inject is, and so what it asks of the table: an inject that evaluates objectives (INJ), a discussion slide – a debrief or reflection prompt, no objective, not in the EEG nor the coverage (DSC) –, or a poll the Players vote on, outside the evaluation too (POL).
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
object
object
What the MSEL needs from the needs analysis to be edited: the objectives to link, the participants recipients must be (M09: the participating areas and, optional, the third parties), the duration limit and the TLP it inherits. Nothing else of the form.
object
object
Capabilities an exercise can validate – TTX-Zone’s own taxonomy.
FIRST Traffic Light Protocol 2.0 labels.
object
A room of the exercise, as the MSEL aims injects at it.
object
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
object
ready blocks DRAFT -> READY_FOR_APPROVAL, approved additionally
blocks READY_FOR_APPROVAL -> APPROVED; warnings never block.
object
One rule a form breaks. section is the form section (0-9) to send
the user to; field the field within it; item_id the row (need,
objective) or value (capability, approver kind) concerned, if any.
One rule a form breaks. section is the form section (0-9) to send
the user to; field the field within it; item_id the row (need,
objective) or value (capability, approver kind) concerned, if any.
One rule a form breaks. section is the form section (0-9) to send
the user to; field the field within it; item_id the row (need,
objective) or value (capability, approver kind) concerned, if any.
Example
{ "actors": [ { "channel": "email", "description": "", "origin": "system", "type": "soc" } ], "attack_techniques": [ { "domain": "enterprise" } ], "injects": [ { "artifact": { "kind": "email", "location": "", "recipient": "", "sender": "", "sender_address": "", "subject": "", "timestamp": "" }, "attack_attribution": "threat_actor", "attack_techniques": [ { "domain": "enterprise" } ], "delivery_method": "email", "files": [], "format": "inject", "images": [], "kind": "mandatory", "origin": "system", "poll_impacts": [], "poll_options": [], "poll_outcomes": [], "poll_question": "", "review_status": "draft", "room_ids": [] } ], "needs": { "objectives": [ { "capability": "detection_triage_escalation", "title": "" } ], "status": "draft", "third_parties": [], "tlp": "clear" }, "phases": [ { "due_objective_ids": [], "headline": "", "incident_jump_minutes": 0 } ], "ready_by": "", "status": "draft", "threat_actors": [ { "origin": "system", "techniques": [ { "domain": "enterprise" } ] } ], "uses_rooms": false}Validation Error
object
object
object
Example generated
{ "detail": [ { "ctx": {}, "input": "example", "loc": [ "example" ], "msg": "example", "type": "example" } ]}