Title Practice
ID RA1001
Description Practice in the real environment. Sharpen Response Actions within your organization
Author @atc_project
Creation Date 2020/04/08
Category General
Stage RS0001: Preparation


Make sure that most of the Response Action has been performed on an internal exercise by your Incident Response Team.
You need to make sure that when an Incident will happen, the team will not just try to follow the playbooks they see first time in their lives, but will be able to quickly execute the actual steps in your environment, i.e. blocking an IP address or a domain name.