How to access After Action Reports

When an exercise ends, Team Sim Managers can access After Action Reports which provide detailed metrics on team performance.

To access these, navigate to exercise in the main navigation menu, Team Sim and then, select the exercise in the managed by me area.

Navigate to the performance tab of the exercise. Find:

A summary After Action Report: this includes performance metrics for all groups that participated in the exercise
After Action Reports per team: metrics on the specific team's performance

Navigate between reports on the left hand-side. You can export the data behind each report to a CSV.

Find a breakdown of what After Action Reports include, and how metrics are calculated, below.

After Action Report Data Points: Summary and Group reports

After Action Reports include:

Tasks completed

The percentage of tasks completed.

Accuracy

Percentage accuracy of responses.

Active participants

Active participants are those that joined the exercise via the join exercise button and may not represent all participants engaging in the exercise. For example, if a team was collaborating virtually, via a screen share, and only one participant joined the exercise and was submitting responses, the team would only have one active participant.

Average active time (summary report) / Active time (group report)

In the group report, active time is the total time that any participant (or multiple participants of the group) were connected to the exercise. If two participants were logged in at the same time, (e.g., between 1pm and 2pm), then this only counts the time of one participant (i.e., one hour in this example).

In the summary report, average active time is calculated by adding the active time of each group and then dividing it by the number of groups, to give an average for the exercise.

Strengths and weaknesses

A list of MITRE ATT&CK techniques groups were strong or weak in, based on the accuracy of responses to tasks mapped against those techniques.

Strengths are those where groups scored equal or over 50%, whereas weaknesses are where accuracy is under 50%, or where tasks were incomplete.

Selecting the MITRE ATT&CK technique hyperlink will take participants to labs mapped against the technique, for them to complete. Managers for organizations that are Cyber Pro customers are able to assign these labs to upskill team members.

Suggested labs

These labs are based on tasks with the lowest accuracy, as each task is mapped to techniques in the MITRE ATT&CK framework. Users can complete this content for further upskilling and as a Manager, you can assign these to your team(s).

Activity summary

In the summary report, you can find a ranking of groups against each other. This is based on the number of tasks completed, and then, the active time taken to submit the final task. Find out more here.

In the group report, the activity summary area displays each individual member's performance, including number of tasks completed, active time, and percentage accuracy across their attempts.

Tasks - completion and attempts

A breakdown of each task against completion status, and MITRE ATT&CK technique mappings.

Tasks - accuracy

A breakdown of each task against percentage accuracy, bringing to light which tasks groups found easier, or more difficult to complete.