How Range works: the incident-response loop
Every scenario runs the full IR loop, detection through recovery, plus the leadership decisions. Here is what each phase asks of you.
Every GraphLattice Range scenario runs the full incident-response loop. You do not just identify the attack, you work it from first alert to recovery, and you make the decisions a leader has to make along the way.
The five phases
Detection
You start where a real responder starts: with signals, not answers. Logs, alerts, and telemetry point at something wrong. Your job is to recognize the attack, understand what is happening, and scope which identities and systems are involved.
Containment
You stop the bleeding without breaking the business. The right move depends on the attack. A stolen session token needs the session revoked, not a password reset. An app-only token needs the service principal disabled. Containment is where the most important calls happen under the most pressure.
Eradication
You remove the attacker access and the persistence they planted. This is where partial responses fail: resetting one account while an attacker holds a forged ticket, an added app credential, or an ACL backdoor leaves them inside. Range scenarios reward finding the real foothold.
Forensics
You reconstruct what happened and scope the damage. What did the attacker reach, what did they take, and what did they leave behind? Good forensics turns an unbounded incident into a known one.
Recovery
You restore trust and normal operations, in the right order. Recovery is also a decision problem: what to rebuild, what to rotate, and how to balance getting back online against being certain the attacker is gone.
The decisions on top
Layered through the phases are the calls a CISO has to make: when to disclose, whether to prioritize recovery or availability, how to handle an extortion clock. Range scores these too, because in a real incident the technical and the executive decisions happen at the same time.
How this maps to the real thing
The phases mirror the incident-response lifecycle your playbooks already use. The point of Range is repetition: you build the muscle memory to run the loop correctly when it is real, under time pressure, with partial information.
Next: how scoring works.