import os import sys import site # Dynamically add user site-packages across Python versions user_site = site.getusersitepackages() if isinstance(user_site, str) and os.path.exists(user_site) and user_site not in sys.path: sys.path.insert(0, user_site) try: from pptx import Presentation from pptx.util import Inches, Pt from pptx.enum.text import PP_ALIGN from pptx.dml.color import RGBColor from pptx.enum.shapes import MSO_SHAPE except ImportError: print("Error: 'python-pptx' package is required to run build_presentation.py.") print("Please install it using: pip install python-pptx") sys.exit(1) def create_deck(): prs = Presentation() # Set slide dimensions to widescreen 16:9 prs.slide_width = Inches(13.333) prs.slide_height = Inches(7.5) # Color Palette (Dark Theme / Cyber Aesthetic) COLOR_BG = RGBColor(11, 15, 25) # Dark navy COLOR_CARD = RGBColor(22, 30, 48) # Card background COLOR_CYAN = RGBColor(0, 242, 254) # Accent cyan COLOR_BLUE = RGBColor(79, 172, 254) # Accent blue COLOR_WHITE = RGBColor(240, 244, 252) # Main text COLOR_MUTED = RGBColor(140, 155, 165) # Muted text COLOR_RED = RGBColor(255, 75, 75) # Alert red COLOR_GOLD = RGBColor(255, 215, 0) # Highlight gold COLOR_GREEN = RGBColor(0, 230, 118) # Success green def apply_dark_bg(slide): background = slide.background fill = background.fill fill.solid() fill.fore_color.rgb = COLOR_BG def add_header(slide, title_text, category_text="RANSOMWARE INCIDENT TABLETOP EXERCISE (TTX)"): # Header background banner header_box = slide.shapes.add_shape(MSO_SHAPE.RECTANGLE, Inches(0), Inches(0), Inches(13.333), Inches(1.1)) header_box.fill.solid() header_box.fill.fore_color.rgb = RGBColor(15, 21, 37) header_box.line.fill.background() tf = header_box.text_frame tf.word_wrap = True tf.margin_left = Inches(0.6) tf.margin_top = Inches(0.15) p_cat = tf.paragraphs[0] p_cat.text = category_text.upper() p_cat.font.size = Pt(10) p_cat.font.bold = True p_cat.font.color.rgb = COLOR_CYAN p_title = tf.add_paragraph() p_title.text = title_text p_title.font.size = Pt(22) p_title.font.bold = True p_title.font.color.rgb = COLOR_WHITE # Top border line glow line = slide.shapes.add_shape(MSO_SHAPE.RECTANGLE, Inches(0), Inches(1.1), Inches(13.333), Inches(0.04)) line.fill.solid() line.fill.fore_color.rgb = COLOR_CYAN line.line.fill.background() # --------------------------------------------------------- # SLIDE 1: Title Slide # --------------------------------------------------------- blank_slide_layout = prs.slide_layouts[6] slide1 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide1) # Hero card box card1 = slide1.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(1.0), Inches(1.0), Inches(11.333), Inches(5.5)) card1.fill.solid() card1.fill.fore_color.rgb = COLOR_CARD card1.line.color.rgb = COLOR_CYAN tf1 = card1.text_frame tf1.word_wrap = True tf1.margin_left = Inches(0.8) tf1.margin_top = Inches(0.8) p = tf1.paragraphs[0] p.text = "šŸ›”ļø CYBERSECURITY INCIDENT RESPONSE DRILL" p.font.size = Pt(14) p.font.bold = True p.font.color.rgb = COLOR_CYAN p2 = tf1.add_paragraph() p2.text = "Ransomware Incident Tabletop Exercise (TTX)" p2.font.size = Pt(36) p2.font.bold = True p2.font.color.rgb = COLOR_WHITE p2.space_before = Pt(10) p3 = tf1.add_paragraph() p3.text = "Off-Site Loan Officer Phishing, C2 Exfiltration & Active Encryption Response Scenario" p3.font.size = Pt(18) p3.font.color.rgb = COLOR_BLUE p3.space_before = Pt(15) p4 = tf1.add_paragraph() p4.text = "ā€¢ Turn-Key Facilitator & Player Presentation Deck\nā€¢ SOP-Aligned RACI Authority & Escalation SLAs\nā€¢ Multi-Department Response: SOC L1/L2/L3, CTI, IT Ops, Asset Owners & Executive Leadership" p4.font.size = Pt(14) p4.font.color.rgb = COLOR_MUTED p4.space_before = Pt(25) # --------------------------------------------------------- # SLIDE 2: Executive Summary & Exercise Objectives # --------------------------------------------------------- slide2 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide2) add_header(slide2, "Executive Summary & Exercise Objectives") # Left Column Card: Overview card_l = slide2.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(0.6), Inches(1.4), Inches(5.8), Inches(5.5)) card_l.fill.solid() card_l.fill.fore_color.rgb = COLOR_CARD card_l.line.color.rgb = COLOR_BLUE tf_l = card_l.text_frame tf_l.word_wrap = True tf_l.margin_left = Inches(0.4) tf_l.margin_top = Inches(0.4) p = tf_l.paragraphs[0] p.text = "šŸ“Œ Scenario Overview" p.font.size = Pt(18) p.font.bold = True p.font.color.rgb = COLOR_CYAN bullets_l = [ "Vector: Remote Loan Officer receives Customer_Documents_2026.zip over Telegram.", "Execution: Trojan executable disguised as PDF triggers fake Adobe Error (0x80070005).", "Lateral Movement: Workstation reconnected to Corporate LAN; Active Directory enumerated.", "Exfiltration: 5GB sensitive customer loan archives siphoned to C2 185.123.45.6.", "Ransomlock: Workstation and network shares (\\\\FS01\\LoanShares) encrypted with .lock extension.", "Demand: Attacker demands 5 Bitcoin ransom within 72 hours." ] for b in bullets_l: p = tf_l.add_paragraph() p.text = "ā€¢ " + b p.font.size = Pt(12) p.font.color.rgb = COLOR_WHITE p.space_before = Pt(8) # Right Column Card: Objectives card_r = slide2.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(6.8), Inches(1.4), Inches(5.9), Inches(5.5)) card_r.fill.solid() card_r.fill.fore_color.rgb = COLOR_CARD card_r.line.color.rgb = COLOR_GOLD tf_r = card_r.text_frame tf_r.word_wrap = True tf_r.margin_left = Inches(0.4) tf_r.margin_top = Inches(0.4) p = tf_r.paragraphs[0] p.text = "šŸŽÆ Core Objectives & Deliverables" p.font.size = Pt(18) p.font.bold = True p.font.color.rgb = COLOR_GOLD bullets_r = [ "RACI Boundary Enforcement: Validate clear distinction between SOC L1, L2, L3, SOC Manager, Asset Owner, and CIO/CISO.", "Containment Velocity: Test SLA speeds (<15 min L1 escalation, <30 min host/network isolation).", "WAR Room Operations: Simulate Incident Communicator setup and executive notification streams.", "Business Recovery: Practice joint CIO & CISO return-to-production approval procedures.", "PIR & Lessons Learned: Review post-incident action tracking and long-term hardening." ] for b in bullets_r: p = tf_r.add_paragraph() p.text = "ā€¢ " + b p.font.size = Pt(12) p.font.color.rgb = COLOR_WHITE p.space_before = Pt(10) # --------------------------------------------------------- # SLIDE 3: The 11 Exercise Roles # --------------------------------------------------------- slide3 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide3) add_header(slide3, "11 Exercise Role Handbooks & RACI Responsibilities") roles_data = [ ("SOC L1 Analyst", "Shift Duty Triage", "Monitor alerts, validate FP/TP, enrich context, ITSM ticket, escalate <15 min."), ("SOC L2 Analyst", "Lead Investigator", "Investigate scope, forensic log analysis, high-sev containment execution, draft report."), ("SOC Lead / L3", "Senior Forensics", "Deep malware analysis, RCA support, authorize major containment, SEV1 support."), ("Incident Communicator", "Comms & WAR Room", "Own WAR Room, notify Execs per SLA, interim reports (NO containment authority)."), ("SOC Manager", "Operational Authority", "Declare Major Incident, approve major containment, engage BCP/DR, oversight."), ("Business / Asset Owner", "Business Context", "Assess business impact, approve prod containment, validate operational recovery."), ("Network & System Team", "Infrastructure Ops", "Execute firewall blocks, AD account locks, endpoint isolation, reimaging."), ("CTI Team", "Threat Intelligence", "Provide IOC enrichment, threat actor attribution, C2 campaign correlation."), ("CIO", "Core System Authority", "Final authority core system crisis, approve SEV1/2 return to production."), ("CISO", "Cyber Governance", "Strategic cyber oversight, regulatory notifications, mandatory recovery sign-off."), ("Executive Management", "Board & Governance", "CIO/CRO/CISO/Cyber Head provide executive risk & regulatory decision governance.") ] cols = 3 rows = 4 width = Inches(3.8) height = Inches(1.25) for i, (title, focus, desc) in enumerate(roles_data): c = i % cols r = i // cols left = Inches(0.6 + c * 4.1) top = Inches(1.4 + r * 1.35) card = slide3.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, left, top, width, height) card.fill.solid() card.fill.fore_color.rgb = COLOR_CARD card.line.color.rgb = COLOR_CYAN if r < 2 else COLOR_GOLD tf = card.text_frame tf.word_wrap = True tf.margin_left = Inches(0.15) tf.margin_top = Inches(0.1) p = tf.paragraphs[0] p.text = f"šŸŽ­ {title}" p.font.size = Pt(13) p.font.bold = True p.font.color.rgb = COLOR_CYAN if r < 2 else COLOR_GOLD p2 = tf.add_paragraph() p2.text = f"Scope: {focus}" p2.font.size = Pt(10) p2.font.bold = True p2.font.color.rgb = COLOR_BLUE p3 = tf.add_paragraph() p3.text = desc p3.font.size = Pt(9) p3.font.color.rgb = COLOR_WHITE # --------------------------------------------------------- # SLIDE 4: RACI Containment Authority Matrix # --------------------------------------------------------- slide4 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide4) add_header(slide4, "RACI Containment & Recovery Authority Matrix") # Table creation rows_cnt = 12 cols_cnt = 4 left = Inches(0.6) top = Inches(1.3) width = Inches(12.133) height = Inches(5.6) table_shape = slide4.shapes.add_table(rows_cnt, cols_cnt, left, top, width, height) table = table_shape.table table.columns[0].width = Inches(2.6) table.columns[1].width = Inches(1.8) table.columns[2].width = Inches(4.733) table.columns[3].width = Inches(3.0) headers = ["Role Title", "Focus Area", "SOP Mandatory Core Responsibilities", "Containment / Recovery Authority"] for j, h in enumerate(headers): cell = table.cell(0, j) cell.fill.solid() cell.fill.fore_color.rgb = RGBColor(15, 21, 37) p = cell.text_frame.paragraphs[0] p.text = h p.font.size = Pt(11) p.font.bold = True p.font.color.rgb = COLOR_CYAN matrix_rows = [ ("SOC L1 Analyst", "Shift Triage", "Monitor alerts, validate FP/TP, enrich context, ITSM ticket, escalate <15 min.", "Predefined Low/Med Playbook"), ("SOC L2 Analyst", "Lead Investigation", "Scope validation, forensic log analysis, draft technical incident reports.", "High Severity (per matrix)"), ("SOC Lead / L3", "Senior Forensics", "Deep malware analysis, RCA support, share full authority during SEV1.", "Major Containment Authorized"), ("Incident Communicator", "Comms & WAR Room", "Own WAR Room, notify Execs per SLA, interim & final incident reports.", "āŒ NO Containment Authority"), ("SOC Manager", "Operational Auth", "Declare Major Incident, approve major containment, engage BCP/DR.", "Full Operational Approval"), ("Business / Asset Owner", "Business Context", "Assess application impact, approve prod containment, validate restoration.", "Production System Approval"), ("Network & System Team", "Infrastructure Ops", "Execute firewall blocks, AD account changes, endpoint host isolation.", "Technical Execution Only"), ("CTI Team", "Threat Intel", "IOC enrichment, campaign correlation, threat actor attribution.", "Intelligence Support Only"), ("CIO", "Core System Auth", "Final authority core system crisis, approve SEV1 & SEV2 production recovery.", "Final Recovery Sign-Off"), ("CISO", "Cyber Governance", "Strategic response oversight, regulatory alignment, mandatory recovery sign-off.", "Strategic & Recovery Sign-Off"), ("Executive Management", "Board Governance", "CIO/CRO/CISO/Cyber Head provide executive risk & regulatory governance.", "Strategic & Regulatory") ] for idx, row_data in enumerate(matrix_rows): for j, val in enumerate(row_data): cell = table.cell(idx + 1, j) cell.fill.solid() cell.fill.fore_color.rgb = COLOR_CARD if idx % 2 == 0 else RGBColor(16, 22, 38) p = cell.text_frame.paragraphs[0] p.text = val p.font.size = Pt(9.5) p.font.color.rgb = COLOR_WHITE if j == 3 and "NO" in val: p.font.color.rgb = COLOR_RED p.font.bold = True elif j == 3 and ("Approval" in val or "Sign-Off" in val): p.font.color.rgb = COLOR_GREEN # --------------------------------------------------------- # SLIDE 5: Inject 1 & 2 - Off-Site Phishing & LAN Recon # --------------------------------------------------------- slide5 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide5) add_header(slide5, "Injects 1 & 2: Phishing Payload Arrival & LAN Reconnaissance") # Inject 1 Box card_i1 = slide5.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(0.6), Inches(1.4), Inches(5.8), Inches(5.5)) card_i1.fill.solid() card_i1.fill.fore_color.rgb = COLOR_CARD card_i1.line.color.rgb = COLOR_RED tf = card_i1.text_frame tf.word_wrap = True tf.margin_left = Inches(0.3) tf.margin_top = Inches(0.3) p = tf.paragraphs[0] p.text = "šŸ“ Inject 1: Unsanctioned Telegram Payload (09:15 AM)" p.font.size = Pt(15) p.font.bold = True p.font.color.rgb = COLOR_RED b1 = [ "Context: Loan Officer working off-site receives Customer_Documents_2026.zip on Telegram.", "Payload: Disguised Signed_Agreement.pdf executable extracts trojan spirit DLL.", "Symptom: Adobe Reader error 0x80070005 pops up. Employee ignores & closes app.", "Undercover Activity: User-level persistence established; C2 beaconing initiated.", "Role Focus (SOC L1): Continuous monitoring, FP vs TP validation, ITSM ticket creation, escalate to L2 < 15 min." ] for item in b1: p = tf.add_paragraph() p.text = "ā€¢ " + item p.font.size = Pt(11) p.font.color.rgb = COLOR_WHITE p.space_before = Pt(6) # Inject 2 Box card_i2 = slide5.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(6.8), Inches(1.4), Inches(5.9), Inches(5.5)) card_i2.fill.solid() card_i2.fill.fore_color.rgb = COLOR_CARD card_i2.line.color.rgb = COLOR_CYAN tf = card_i2.text_frame tf.word_wrap = True tf.margin_left = Inches(0.3) tf.margin_top = Inches(0.3) p = tf.paragraphs[0] p.text = "šŸ“ Inject 2: Corporate LAN Reconnection (02:00 PM)" p.font.size = Pt(15) p.font.bold = True p.font.color.rgb = COLOR_CYAN b2 = [ "Context: Employee returns to office and plugs LOAN-LAPTOP-042 into HQ LAN.", "Lateral Movement: Malware detects AD domain controller & enumerates Kerberos tokens.", "Targeting: Discovers accessible file shares (\\\\FS01\\LoanShares) under j.smith.", "Role Focus (CTI Team): Track callback IPs, enrich IOCs, cross-reference campaign patterns." ] for item in b2: p = tf.add_paragraph() p.text = "ā€¢ " + item p.font.size = Pt(11) p.font.color.rgb = COLOR_WHITE p.space_before = Pt(8) # --------------------------------------------------------- # SLIDE 6: Inject 3 & 4 - Mass Exfiltration & Ransomware Lock # --------------------------------------------------------- slide6 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide6) add_header(slide6, "Injects 3 & 4: Data Exfiltration & Active Ransomware Crisis") # Inject 3 Box card_i3 = slide6.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(0.6), Inches(1.4), Inches(5.8), Inches(5.5)) card_i3.fill.solid() card_i3.fill.fore_color.rgb = COLOR_CARD card_i3.line.color.rgb = COLOR_GOLD tf = card_i3.text_frame tf.word_wrap = True tf.margin_left = Inches(0.3) tf.margin_top = Inches(0.3) p = tf.paragraphs[0] p.text = "šŸ“ Inject 3: 5GB Data Exfiltration (02:25 PM)" p.font.size = Pt(15) p.font.bold = True p.font.color.rgb = COLOR_GOLD b3 = [ "Context: Attacker initiates 5GB compressed archive siphon to C2 IP 185.123.45.6.", "SIEM Alerts: Outbound HTTPS Traffic Spike + Abnormal SMB Read Volume on \\\\FS01.", "Role Focus (SOC L2): Lead investigation, confirm severity level, scope impact, timeline reconstruction." ] for item in b3: p = tf.add_paragraph() p.text = "ā€¢ " + item p.font.size = Pt(11) p.font.color.rgb = COLOR_WHITE p.space_before = Pt(8) # Inject 4 Box card_i4 = slide6.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(6.8), Inches(1.4), Inches(5.9), Inches(5.5)) card_i4.fill.solid() card_i4.fill.fore_color.rgb = COLOR_CARD card_i4.line.color.rgb = COLOR_RED tf = card_i4.text_frame tf.word_wrap = True tf.margin_left = Inches(0.3) tf.margin_top = Inches(0.3) p = tf.paragraphs[0] p.text = "šŸ“ Inject 4: Active Encryption & HelpDesk Crisis (02:32 PM)" p.font.size = Pt(15) p.font.bold = True p.font.color.rgb = COLOR_RED b4 = [ "Context: Ransomware component triggers! Local & \\\\FS01 files locked with .lock extension.", "Lock Screen: Red notice demands 5 BTC within 72 hours; workstation freezes.", "EDR Alert: CRITICAL SEV-1: Ransomware Execution Detected on LOAN-LAPTOP-042.", "Role Focus (SOC L3 & SOC Manager): Declare SEV-1 Major Incident & authorize major containment." ] for item in b4: p = tf.add_paragraph() p.text = "ā€¢ " + item p.font.size = Pt(11) p.font.color.rgb = COLOR_WHITE p.space_before = Pt(8) # --------------------------------------------------------- # SLIDE 7: Inject 5 & 6 - WAR Room Containment & Recovery # --------------------------------------------------------- slide7 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide7) add_header(slide7, "Injects 5 & 6: Incident Command WAR Room & Clean Recovery") # Inject 5 Box card_i5 = slide7.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(0.6), Inches(1.4), Inches(5.8), Inches(5.5)) card_i5.fill.solid() card_i5.fill.fore_color.rgb = COLOR_CARD card_i5.line.color.rgb = COLOR_BLUE tf = card_i5.text_frame tf.word_wrap = True tf.margin_left = Inches(0.3) tf.margin_top = Inches(0.3) p = tf.paragraphs[0] p.text = "šŸ“ Inject 5: WAR Room & Multi-Team Containment (02:45 PM)" p.font.size = Pt(15) p.font.bold = True p.font.color.rgb = COLOR_BLUE b5 = [ "WAR Room Setup: Incident Communicator establishes WAR Room & notifies CISO/CIO < 15 min.", "Network Containment: Network/System Team applies firewall block for 185.123.45.6.", "Identity Lock: Disable AD account j.smith & purge SMB Kerberos sessions.", "Production Guard: Business Owner approves \\\\FS01\\LoanShares Read-Only isolation." ] for item in b5: p = tf.add_paragraph() p.text = "ā€¢ " + item p.font.size = Pt(11) p.font.color.rgb = COLOR_WHITE p.space_before = Pt(8) # Inject 6 Box card_i6 = slide7.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(6.8), Inches(1.4), Inches(5.9), Inches(5.5)) card_i6.fill.solid() card_i6.fill.fore_color.rgb = COLOR_CARD card_i6.line.color.rgb = COLOR_GREEN tf = card_i6.text_frame tf.word_wrap = True tf.margin_left = Inches(0.3) tf.margin_top = Inches(0.3) p = tf.paragraphs[0] p.text = "šŸ“ Inject 6: Eradication, Clean Backup & Sign-Off (Days 2-3)" p.font.size = Pt(15) p.font.bold = True p.font.color.rgb = COLOR_GREEN b6 = [ "Eradication: LOAN-LAPTOP-042 reimaged with hardened gold image & updated EDR.", "Restoration: File shares restored from clean immutable snapshot (98% validated).", "Business Sign-Off: Business Asset Owner confirms operational application readiness.", "Executive Blessing: Joint CIO & CISO sign-off mandatory for return-to-production.", "Post-PIR Enforcer: SOC Manager tracks overdue action items per 72-hr SLA." ] for item in b6: p = tf.add_paragraph() p.text = "ā€¢ " + item p.font.size = Pt(11) p.font.color.rgb = COLOR_WHITE p.space_before = Pt(6) # --------------------------------------------------------- # SLIDE 8: Visual Threat Mockups & Evidence Showcase # --------------------------------------------------------- slide8 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide8) add_header(slide8, "Visual Incident Assets & Threat Mockups Showcase") shots = [ ("assets/telegram_phishing.jpg", "Telegram Phishing Vector"), ("assets/fake_pdf_error.jpg", "Fake Adobe Reader Error"), ("assets/edr_ransomware_alert.jpg", "CrowdStrike EDR SEV-1 Alert"), ("assets/ransomware_note.jpg", "Workstation Ransom Lock Screen"), ("assets/siem_dashboard.jpg", "SIEM Event Correlation"), ("assets/war_room_dashboard.jpg", "Incident Command WAR Room") ] for idx, (path, title) in enumerate(shots): c = idx % 3 r = idx // 3 left = Inches(0.6 + c * 4.1) top = Inches(1.4 + r * 2.75) width = Inches(3.8) height = Inches(2.5) card = slide8.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, left, top, width, height) card.fill.solid() card.fill.fore_color.rgb = COLOR_CARD card.line.color.rgb = COLOR_CYAN # Embed Image if present abs_path = os.path.join(os.getcwd(), path) if os.path.exists(abs_path): try: slide8.shapes.add_picture(abs_path, left + Inches(0.1), top + Inches(0.4), width=width - Inches(0.2), height=height - Inches(0.5)) except Exception as e: print(f"Error loading image {path}: {e}") # Title banner on image top banner = slide8.shapes.add_shape(MSO_SHAPE.RECTANGLE, left, top, width, Inches(0.35)) banner.fill.solid() banner.fill.fore_color.rgb = RGBColor(15, 21, 37) banner.line.fill.background() p = banner.text_frame.paragraphs[0] p.text = f"šŸ“ø {title}" p.font.size = Pt(10) p.font.bold = True p.font.color.rgb = COLOR_CYAN # --------------------------------------------------------- # SLIDE 9: Evaluation KPI Scoring Rubric # --------------------------------------------------------- slide9 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide9) add_header(slide9, "TTX Evaluation Rubric & Target Response SLAs") kpi_card = slide9.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(0.6), Inches(1.4), Inches(12.133), Inches(5.5)) kpi_card.fill.solid() kpi_card.fill.fore_color.rgb = COLOR_CARD kpi_card.line.color.rgb = COLOR_GOLD tf = kpi_card.text_frame tf.word_wrap = True tf.margin_left = Inches(0.4) tf.margin_top = Inches(0.4) p = tf.paragraphs[0] p.text = "šŸ“Š Key Performance Indicators (KPIs) & SLA Benchmark" p.font.size = Pt(18) p.font.bold = True p.font.color.rgb = COLOR_GOLD kpis = [ ("L1 Alert Validation SLA (< 15 Min)", "L1 validates True Positive state, enriches asset context, opens ITSM ticket, and escalates to L2 (or SOC Manager directly if L2 is unavailable)."), ("L2/L3 Containment Speed (< 30 Min)", "L2 leads investigation; Network/System team executes host isolation, firewall C2 blocks, and AD account lockouts per RACI matrix."), ("Executive Notification SLA (< 15 Min)", "Incident Communicator notifies CISO, CIO, and Cybersecurity Division Head immediately upon SEV-1 confirmation."), ("WAR Room Establishment (< 30 Min)", "Central Incident Command WAR Room established with representatives active across all 11 defined role profiles."), ("Clean Snapshot Restoration (< 4 Hours)", "System engineers restore 98%+ clean file shares from immutable backups; Asset Owner verifies operational data integrity."), ("Joint Executive Sign-Off (< 24 Hours)", "Mandatory formal return-to-production approval granted by both CIO and CISO prior to incident closure.") ] for title, desc in kpis: p_title = tf.add_paragraph() p_title.text = f"ā±ļø {title}" p_title.font.size = Pt(13) p_title.font.bold = True p_title.font.color.rgb = COLOR_CYAN p_title.space_before = Pt(8) p_desc = tf.add_paragraph() p_desc.text = desc p_desc.font.size = Pt(11) p_desc.font.color.rgb = COLOR_WHITE # --------------------------------------------------------- # SLIDE 10: Conclusion & Next Steps # --------------------------------------------------------- slide10 = prs.slides.add_slide(blank_slide_layout) apply_dark_bg(slide10) add_header(slide10, "Exercise Wrap-Up, PIR & Action Items") card_fin = slide10.shapes.add_shape(MSO_SHAPE.ROUNDED_RECTANGLE, Inches(1.5), Inches(1.5), Inches(10.333), Inches(5.0)) card_fin.fill.solid() card_fin.fill.fore_color.rgb = COLOR_CARD card_fin.line.color.rgb = COLOR_GREEN tf = card_fin.text_frame tf.word_wrap = True tf.margin_left = Inches(0.6) tf.margin_top = Inches(0.6) p = tf.paragraphs[0] p.text = "šŸš€ Post-Incident Review (PIR) & Action Plan" p.font.size = Pt(22) p.font.bold = True p.font.color.rgb = COLOR_GREEN next_steps = [ "Document Observations: Facilitator compiles evaluator notes and player responses into After-Action Report (AAR).", "Enforce Action Item Tracking: SOC Manager tracks assigned PIR recommendations with 30/60/90 day SLA deadlines.", "Harden Remote Workflows: Review Telegram / external chat policy & enforce automated sandbox attachment scanning.", "Refine Playbooks: Update Account Compromise & Ransomware Playbooks based on TTX findings.", "Portal & Slide Deck Deck Access: Access full interactive portal via index.html." ] for s in next_steps: p = tf.add_paragraph() p.text = "āœ” " + s p.font.size = Pt(14) p.font.color.rgb = COLOR_WHITE p.space_before = Pt(14) output_path = "Ransomware_Incident_TTX_Presentation.pptx" prs.save(output_path) print(f"SUCCESS: Presentation generated at {os.path.abspath(output_path)}") if __name__ == "__main__": create_deck()