Cloud Heights Guard Post — Security Incident Strategy Session
Scene 01 — Incident Briefing
Decide what you need to know about incident CH-8080 before anyone touches a rule.
Ivy says: Ticket CH-8080 just landed at the Guard Post. Application unreachable on TCP 8080, and that is genuinely all we have.
Ivy says: Before we touch the ledger — what questions would keep us from solving the wrong problem?
Incident Response Room
A closed room with a physical evidence board and a shared timeline.
Cloud Heights guard post
What do you need to know before you change anything?
Select the questions you want answered. Every answer stays on the board. No rule is edited in this scene.
Incident ticket · CH-8080
Student application unreachable
- Affected service:
- Student application
- Destination:
- Assigned Student VM
- Protocol:
- TCP
- Port:
- 8080
- Reported symptom:
- Application unreachable
- Required source:
- Grid Beacon 10.60.6.4
The ticket does not say whether this is routing, a security rule, rule priority, service availability, or something else. Nothing here identifies a cause.
Evidence requests · 0 of 8 essential questions asked
Answers stay on the board. Ask as many questions as the room wants — nothing is changed in this scene.
On screen
- Incident
- CH-8080Unknown
Reported symptom only. No cause identified.
Reset the board to run the questioning again with a different group.