A playbook tells you what to do. Cyber Battle Pro helps you lead the people doing it.
It walks the incident commander and the section through an incident, all the way to the after action review. The IC issues orders and tasks, the analysts record what they find, and everyone works from one timeline. It follows PICERL with the battle procedure on top, and members need nothing more than a browser.
- Free to use, all rights reserved
- Runs on a local network, no cloud
- Session kept in memory only
- Task done: Cpl Roy, scope affected hosts (was in progress)
- ACK: Sgt Lavoie acknowledged White Cell inject: media inquiry about the finance outage.
- FINDING (Malware): Beaconing every 60 s to 203.0.113.7 [T1071.001]. Affected: WS-114, FS-02
- HOST WS-114: Isolated
- RFI 1 to WC (Urgent): Who owns FS-02 and can it be isolated? Needed by 1000 14 Oct 26 EDT.
- INCIDENT DECLARED INC-261014-27, SEV2. IC: Sgt Lavoie.
- ORDERS issued by Sgt Lavoie. Tasks: 3
- WARNING ORDER issued to Cpl Roy, Cpl Ouellet, MCpl Gagnon.
Sample exercise data. Names, hosts and addresses are invented.
One incident in seven frames
Click through it here, or press Present to brief your section from a projector. The arrow keys work in both.
The section joins from a browser
Only the IC laptop runs the Field HQ. Members connect to the section network, scan the QR code or type the address, check the certificate fingerprint and enter the access code. Nothing gets installed on their phones or laptops.
- Several teams can share one exercise network, each with its own HQ, code and address.
- The IC makes one member 2IC and one member Intel from this panel.
- A network check spots Windows firewall problems and fixes them in one click.
Get the section moving with a warning order
The fields come filled with sensible default text, so the IC edits instead of writing from a blank page. Issue it and every member gets a banner on their own device that they have to acknowledge.
- The back brief picks up its mission and timings, so nobody types them twice.
- Copy any order as plain text, or download it as a formatted PDF.
- Only the IC and the 2IC can issue orders.
Issue the full orders
Situation, higher intent, mission, execution, service support, command and signal. Tasks go to named members, and each member sees a New task banner on their own device until they acknowledge it.
- Every acknowledgement is logged with the name and the time.
- The PDF comes out with numbered paragraphs and a signature line.
Declare the incident and start the clock
Give the incident an ID, pick the severity and fill in the 5W. The moment you declare, the H clock starts and every log line after it carries H+ time.
- Each severity card carries its criteria, the escalation and how far to compress the battle procedure.
- The section roster sits on the same page: name, role, callsign.
- Zulu time everywhere, with local time right beside it.
Findings that hold up later
Each finding is stamped and signed with the analyst's name. Files are hashed with SHA-256 the moment you attach them. Anything too big or too dangerous to carry around, like a memory image or a malware sample, goes in as a reference with its hash and where it is stored.
- Every artifact writes a CUSTODY line in the log.
- Machines named in findings land on the host board with their status.
- IP addresses, domains, hashes and accounts are pulled out, deduplicated and defanged for you.
The White Cell plays higher HQ
On an exercise, one more laptop runs as the White Cell. It sees each team's status and the RFIs and RFCs they address to WC. From there it answers, approves or rejects, and sends injects to one team or to all of them.
- It never sees findings, logs, SITREPs, orders or tasks.
- Injects reach the IC and the 2IC as a banner with Acknowledge.
- Response times are tracked and export to CSV for the hot wash.
Stand down, review, report
Stand down stops the clock and records the end state, the evidence handover and the residual risk. The after action review comes next, and members can add their own sustain and improve points. Then one click turns the whole session into a deck for the hot wash.
- The findings journal exports to PDF with the original files embedded.
- When the IC ends the session, the HQ clears its memory and closes.
Fourteen steps, four phases
Every step is a form with real default text that you edit, not a blank page. Open the steps in whatever order the situation calls for. On an exercise the orders usually come first and the declaration follows. In a real incident you would normally declare first.
Orders
Issued by the IC or the 2IC, acknowledged by each member.
- Warning order
- Back brief
- Orders (SMESC)
Declare
Severity, 5W and the section roster. Starts the H clock.
- Declare incident
Execute
Used over and over as the incident unfolds.
- Operations and task board
- Findings journal
- Host board
- Request for information
- Request for change
- SITREP
- FRAGO
- Consolidate logs
Close
Stops the clock and captures what to keep and what to fix.
- Stand down
- After action review
What it takes off your hands
The paperwork side of an incident, done while the incident is still running.
Zulu and local time on everything
Times read like 1442 14 Oct 26 with local time beside them. Every log line carries Zulu, local and H+ time, so the timeline reads the same for everyone.
Orders that read like orders
Warning order, back brief and SMESC orders in the format the section already knows. Copy any of them as text, or download a PDF with numbered paragraphs and a signature line.
Command rights the HQ enforces
Only the IC and the 2IC can declare, issue orders and FRAGOs, change the phase or severity, edit the roster or assign tasks. Everyone else records findings, RFIs, RFCs and SITREPs.
Evidence with a chain of custody
Files up to 10 MB are attached and hashed with SHA-256. Executables, memory and disk images and packet captures are recorded as references with their hash and storage location.
IOCs pulled out for you
IP addresses, domains, URLs, hashes, files, hosts and accounts are extracted from findings and log entries, normalized, deduplicated and defanged. Export the list to CSV.
One timeline from many devices
Analysts working without the HQ send their log as a file. The IC imports them all, exact duplicates drop out, and similar entries from different analysts show side by side to merge or keep.
MITRE ATT&CK on findings
Link common techniques, grouped by tactic, to each finding. They follow the finding into the PDF journal and the PowerPoint deck.
Reports at the end, not after midnight
One export builds a widescreen deck with the declaration, mission, tasks, findings, host board, IOCs, evidence register, timeline, SITREPs, RFIs, RFCs, FRAGOs, stand down and AAR.
One laptop, or the whole section on the net
Start alone in a browser tab. When the section is in the same room, the IC laptop becomes a small HQ and everyone works on the same incident live.
Solo
- Open the app in a browser, or from the offline HTML file.
- Everything you enter stays in that browser tab, in memory.
- Send your log to the IC as a file over Signal, Teams or a USB key.
- The IC imports the files and merges them into one timeline.
Field HQ
- The IC double clicks
CBP-HQ.exeand types the team label. - Members join from a phone or a laptop with the QR code or the address.
- Orders, tasks, findings and the log sync live over the local network.
- End the session or close the window and the memory is wiped.
An exercise with four teams and a White Cell
Each IC runs an HQ for their own team. Codes, certificates and addresses are separate, so a member can only join their own team. The White Cell finds every HQ started with the exercise code on the same network.
Memory only. Nothing left behind.
Made for a room where the network may already be compromised and the evidence has to stand up afterwards.
No session data on disk
The session lives in memory on the HQ and in each browser. When the IC ends it or closes the window, it is gone. The only files the HQ keeps are its certificate and key.
An access code, not the incident number
Every HQ makes a readable random code like RAVEN-4721. Ten wrong tries from one device block that device for ten minutes.
Encrypted between devices
Members connect over TLS. The HQ makes its own certificate and shows the fingerprint so people can check it, or you can load one from a training CA or your PKI.
Command rights checked at the HQ
Orders, phase, severity, roster and tasks are accepted only from the IC and the 2IC. Anything else is refused by the server, not just hidden in the page.
The IC console stays on the IC laptop
The Section panel, the code and the network fix only answer to the laptop running the HQ. Connections from other web origins are refused.
Keep the section off the compromised network
Run the HQ on a separate network. On a shared exercise network that carries a red team, give each team its own Wi-Fi or VLAN.
Version 1.8.0
Most people only need the Windows build for the IC laptop. Members never install anything.
Check the file before you run it
Compare the SHA-256 on the card with the one your computer calculates. They must match exactly.
Get-FileHash -Algorithm SHA256 .\CBP-HQ-*.zip
sha256sum cbp-field-hq-*-linux-x64.tar.gz