You are the incident commander. Real attack scenarios, a burning clock, and decisions with consequences. Finish the op and get an after-action report: what you caught, what you missed, and the MITRE ATT&CK techniques behind it.