How SAGA
fits together.
Follow the relationships between a scenario, the world it creates, and the evidence people use to understand it.
The logical model.
Each part has a responsibility. The useful question is what it contributes to the exercise and what it passes to the next part.
Scenario intent
The story, objectives, boundaries, and evidence an exercise is designed to produce.
Exercise control
Prepare the conditions.
Validate the intended paths.
Reset for the next run.
Exercise world
Identities, applications, and user activity, connected by a believable business story.
Observation
Collect the signals.
Preserve the evidence.
Reconstruct what happened.
Debrief & learning
Compare observations with the intended outcome. Carry technical findings and analyst decisions into the next exercise.
Roles stay clear.
Implementations can change.
Exercise control prepares and resets the conditions. The exercise world gives activity a context. Observation preserves what happened. The debrief turns those observations into learning.
A role may span several tools, and one tool may support several roles. The model stays useful as the underlying implementation evolves.
Explore the responsibilities.
Open a role for a little more context.
Scenario intent & exercise control
The scenario sets the story, learning objectives, allowed activity, expected observations, and conditions for success. Exercise control turns that intent into a prepared, validated environment.
Reset belongs to this responsibility too: the next exercise should start from known conditions rather than inherit unexplained changes.
The exercise world
Identities, applications, and user activity form a business context. Their relationships give an action meaning: who can access what, which dependency matters, and why a sequence of events is plausible.
Adversary activity and defender decisions are two perspectives on this shared world. Their specific paths depend on the scenario.
Observation & evidence
Observation makes the activity available for investigation. Identity, application, endpoint, and network signals help an analyst reconstruct what happened.
Evidence connects those observations to the exercise objectives. It should support a reasoning chain rather than become an undifferentiated collection of logs.
Debrief & knowledge
The debrief compares what was intended, what happened, and what participants understood. Technical findings sit alongside analyst decisions, ambiguity, and communication.
Useful lessons inform scenario revisions, defensive improvements, and future exercises. Public research is a separate, reviewed summary of that learning.
One story.
Several connected questions.
Consider an exercise in which an account is misused to perform an unexpected action in a business application.
- Scenario intent
- Can the analyst recognize the account misuse and explain its consequence?
- Exercise world
- An identity has access to an application. Activity within that relationship creates the event the exercise is designed around.
- Observation
- Which identity and application signals reveal the sequence? What additional context does the analyst need?
- Debrief
- Compare the explanation with the intended story. Identify a useful detection improvement or a better question for the next exercise.
Illustrative scenario, not a report of a live run.
Give the exercise
a clearer purpose.
Talk to Claes about scenario design, lab engineering, or collaboration.