Learning Targets:

1. Author and tune Sigma/SIEM detection content mapped to ATT&CK, establishing baselines and thresholds to reduce false positives.

2. Correlate endpoint, network, and radio telemetry to reconstruct the attack chain and identify pivot points in the SIEM.

3. Prioritize alerts using risk scoring and mission impact to meet triage SLAs for high-severity incidents.

4. Execute SOAR playbooks to contain threats (e.g., quarantine hosts, disable credentials, block C2) and record all automated actions.

5. Measure and report mean time to detect (MTTD), false-positive rate, and time-to-contain for each simulated scenario.

Modules

Learning Targets:

1. Establish an incident command structure with defined roles, responsibilities, and escalation paths per NIST SP 800-61.

2. Lead iterative OODA cycles to decide and act within defined timeboxes for containment and eradication steps.

3. Coordinate secure, ROE-compliant communications, including crypto-enabled alternates during jamming or primary channel loss.

4. Restore prioritized services to meet RTO/RPO targets using validated backups and IaC automation; verify integrity via checksums and test transactions.

5. Document actions, evidence, and decisions in an auditable log, preserving chain of custody.

Modules

Learning Targets:

1. Design and implement Zero Trust policies (least privilege, MFA, continuous verification) and microsegmentation via SDN or policy engines.

2. Deploy and tune deception assets (honeypots, honeytokens) and integrate their telemetry into the SIEM for early-warning detections.

3. Implement and test anti-jamming strategies (frequency hopping, power control, directional antennas) using SDR-based assessments.

4. Conduct chaos experiments and failover drills to validate resilience; update runbooks based on observed weaknesses.

5. Quantify resilience with mission-focused KPIs (service availability, RTO/RPO adherence, mission continuity scores) and report trends.

6. Implement OT/ICS safing procedures and enforce IT/OT segmentation; validate fail-safe states during simulated cyber-physical attacks.

Modules

Learning Targets:

1. Configure reinforcement learning agents with reward functions aligned to defined threat models and mission disruption KPIs while enforcing safety constraints.

2. Generate adversarial perturbations/tests (e.g., with established libraries) to assess model robustness and record degradation metrics.

3. Calibrate decision-support thresholds and implement human approval/override mechanisms; test fail-safe behaviors.

4. Monitor model performance, drift, and latency; trigger retraining or rollback based on predefined guardrails.

5. Produce model cards and risk assessments documenting data lineage, intended use, limitations, and operational safeguards.

Modules

Learning Targets:

1. Compile a time-sequenced attack/defense timeline and evidence package from SIEM/SOAR logs, packet captures, and system artifacts.

2. Derive root causes and contributing factors using 5 Whys and fault tree or FMEA analyses.

3. Map existing and proposed controls to MITRE D3FEND techniques to identify coverage gaps.

4. Prioritize remediation backlog by estimated risk reduction and cost-benefit; assign accountable owners and due dates.

5. Brief leadership with an executive summary, heatmaps, and decision options; capture decisions and resourcing implications.

Modules