Transition MSEL
Moving to READY records who did it (no step-up: like validating an inject, it’s a reviewer’s sign-off, undone by going back to DRAFT).
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”object
Responses
Section titled “Responses”Successful Response
object
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
With its names in the pinned release (English, as MITRE publishes them) – kept in snapshots, so a frozen MSEL reads on its own.
object
A version of the MSEL frozen when it became READY, and the sessions played from it.
object
object
An inject’s content rendered as a simulated artifact. The body is the
inject’s own content; these are the template’s other fields, whose
meaning follows kind (email: from, address, to, subject, date; press
release: outlet, dateline, headline, date; social post: author, handle,
date; chat message: sender, channel, date). All plain text: the
Playground draws them, nothing is ever rendered as markup.
object
How the Playground renders an inject’s content as a simulated artifact (a template drawn by the app, never uploaded markup).
Whose activity an inject’s ATT&CK techniques are: a threat actor of the scenario’s, or noise – unrelated activity (other attackers, commodity malware, coincidences, false positives) that tests the players’ triage. None (the column null): no ATT&CK at all.
With its names in the pinned release (English, as MITRE publishes them) – kept in snapshots, so a frozen MSEL reads on its own.
object
object
object
What an inject is, and so what it asks of the table: an inject that evaluates objectives (INJ), a discussion slide – a debrief or reflection prompt, no objective, not in the EEG nor the coverage (DSC) –, or a poll the Players vote on, outside the evaluation too (POL).
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
object
object
What the MSEL needs from the needs analysis to be edited: the objectives to link, the participants recipients must be (M09: the participating areas and, optional, the third parties), the duration limit and the TLP it inherits. Nothing else of the form.
object
object
Capabilities an exercise can validate – TTX-Zone’s own taxonomy.
FIRST Traffic Light Protocol 2.0 labels.
object
A room of the exercise, as the MSEL aims injects at it.
object
object
Where a simulated actor comes from – the actor library’s levels. An exercise’s cast only holds copies; the origin says of what.
object
ready blocks DRAFT -> READY_FOR_APPROVAL, approved additionally
blocks READY_FOR_APPROVAL -> APPROVED; warnings never block.
object
One rule a form breaks. section is the form section (0-9) to send
the user to; field the field within it; item_id the row (need,
objective) or value (capability, approver kind) concerned, if any.
One rule a form breaks. section is the form section (0-9) to send
the user to; field the field within it; item_id the row (need,
objective) or value (capability, approver kind) concerned, if any.
One rule a form breaks. section is the form section (0-9) to send
the user to; field the field within it; item_id the row (need,
objective) or value (capability, approver kind) concerned, if any.
Example
{ "actors": [ { "channel": "email", "description": "", "origin": "system", "type": "soc" } ], "attack_techniques": [ { "domain": "enterprise" } ], "injects": [ { "artifact": { "kind": "email", "location": "", "recipient": "", "sender": "", "sender_address": "", "subject": "", "timestamp": "" }, "attack_attribution": "threat_actor", "attack_techniques": [ { "domain": "enterprise" } ], "delivery_method": "email", "files": [], "format": "inject", "images": [], "kind": "mandatory", "origin": "system", "poll_impacts": [], "poll_options": [], "poll_outcomes": [], "poll_question": "", "review_status": "draft", "room_ids": [] } ], "needs": { "objectives": [ { "capability": "detection_triage_escalation", "title": "" } ], "status": "draft", "third_parties": [], "tlp": "clear" }, "phases": [ { "due_objective_ids": [], "headline": "", "incident_jump_minutes": 0 } ], "ready_by": "", "status": "draft", "threat_actors": [ { "origin": "system", "techniques": [ { "domain": "enterprise" } ] } ], "uses_rooms": false}Validation Error
object
object
object
Example generated
{ "detail": [ { "ctx": {}, "input": "example", "loc": [ "example" ], "msg": "example", "type": "example" } ]}