| Title | Practice |
|---|---|
| ID | RA1001 |
| Description | Practice in the real environment. Sharpen Response Actions within your organization |
| Author | @atc_project |
| Creation Date | 2020/04/08 |
| Category | General |
| Stage | RS0001: Preparation |
Workflow
Make sure that most of the Response Action has been performed on an internal exercise by your Incident Response Team.
You need to make sure that when an Incident will happen, the team will not just try to follow the playbooks they see first time in their lives, but will be able to quickly execute the actual steps in your environment, i.e. blocking an IP address or a domain name.