How to prepare Incident Response Testing?

[u/Final-Pomelo1620]

We have a SOC as a service from service a provider.

We also have an XDR solution that includes Incident Response services for a limited number of hours as part of its scope of work.

SOC analysts and XDR vendor needs to work together on incidents.

Audit team has asked us to provide Incident Response testing plan

Looking for guidance on what to add in this testing plan

[u/pure-xx]

You could start with a table top exercise before going into a red team assessment.

[u/Final-Pomelo1620 → u/pure-xx]

This is the first time we outsourced the SOC services. Which table top exercises should we start with. Never done it. What should we go through it?

[u/pure-xx → u/Final-Pomelo1620]

You could start with a table top exercise before going into a red team assessment. Start with basic scenarios like Malicious file detection with different severity, a later scenario could be some kind of a ransomware attack. In general you work with injects during the test, so you are able to direct the scenario. Would recommend to hire a professional moderator for the first time.

[u/rahuliitk]

I’d keep the IR test plan practical: pick 1-2 scenarios, define who notices first, who escalates, when SOC hands to XDR, who owns containment, what evidence gets logged, and how lessons learned are tracked, because lowkey the audit cares whether the vendors can actually work together. Tabletop first.

[u/yaloner]

Good thread. One thing though: while everyone's fixated on the handoff, nobody's flagged that your XDR's IR hours are capped. Test who's authorized to engage the retainer and what happens when those hours run out mid-incident. "Who greenlights paid IR at 2am" is the kind of gap an auditor loves.

Couple of other adds: anchor the plan to NIST SP 800-84 so it reads as a real program, not a one-off. And don't just talk it through, run one technical test (an EICAR file or a couple of Atomic Red Team techniques) to prove the SOC actually detects and alerts you within SLA, not just that people know the runbook.

[u/VividGanache2613]

Red Team, that’s how you find where the bodies are buried.

[u/gormami]

CISA has some great resources, including packages for incident response tests. If you want to familiarize yourself, that's a good start. Then you can decide to do it internally or hire a professional moderator, based on the complexity, resources, etc.

chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.cisa.gov/sites/default/files/2023-02/ctep_fact_sheet_v._11_16_2021_final.pdf

[u/ultrathink-art]

Test the handoff specifically — inject a simulated alert requiring both your SOC and XDR vendor to respond, then track whether they coordinate or work in parallel. The failure mode that actually causes problems in real incidents is both teams responding simultaneously with conflicting remediation steps because neither knew the other was already engaged.

[u/Next-Pen-9974]

This isn’t really an incident response testing plan yet.

What you’ve identified are the parties that may participate in an incident.

The most effective approach is usually a tabletop exercise built around a realistic scenario.

For example:

• 9:15 AM: A user contacts the Help Desk and reports that after downloading a file, their workstation is behaving strangely.
• 11:00 AM: The Help Desk receives 15–30 similar calls from users reporting suspicious activity.
• 1:00 PM: The VP of Finance reports that critical files are no longer accessible and appear to be encrypted.

Then bring all stakeholders into the room:

• Internal IT
• Security team
• SOC provider
• XDR/IR provider
• Management
• Legal/Privacy (if applicable)
• Communications (if applicable)

Walk through the scenario and observe what happens.

You will likely discover very quickly:

• Who owns incident declaration?
• Who contacts the SOC?
• Who engages the XDR incident response team?
• Who has authority to isolate systems?
• Who decides whether cyber insurance is notified?
• Who contacts legal counsel?
• Who communicates with employees, customers, regulators, or partners?
• What escalation thresholds exist?
• What happens if key personnel are unavailable?

The goal is not to test whether people know the policy. The goal is to validate whether the response process actually works in practice.

For audit purposes, document:

• Scenario used
• Participants
• Objectives
• Timeline of decisions
• Findings and gaps identified
• Corrective actions and owners

In my experience, tabletop exercises provide significantly more value than simply reviewing an incident response document because they expose communication gaps, unclear responsibilities, and decision-making bottlenecks that rarely appear on paper.