diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..d22fbf2eaa4696f869ffcdf0f8f6fe1fa6908a2a Binary files /dev/null and b/.DS_Store differ diff --git a/backend b/backend index 326d3d315f05fc06203f292a6c8ca1e6e56dfde0..2ab2147b637951a2a16510e2c138ba1fbe9c67df 160000 --- a/backend +++ b/backend @@ -1 +1 @@ -Subproject commit 326d3d315f05fc06203f292a6c8ca1e6e56dfde0 +Subproject commit 2ab2147b637951a2a16510e2c138ba1fbe9c67df diff --git a/docs/.DS_Store b/docs/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..4816cd657f486394e46aa424fe3e180780ec28c2 Binary files /dev/null and b/docs/.DS_Store differ diff --git a/docs/INJECT_process/define/learning_objectives_and_activities.md b/docs/INJECT_process/define/learning_objectives_and_activities.md new file mode 100644 index 0000000000000000000000000000000000000000..094d784acda2c3f97857336dbfade9ec7d823cb1 --- /dev/null +++ b/docs/INJECT_process/define/learning_objectives_and_activities.md @@ -0,0 +1,30 @@ +TBD + +5. Addons storylines + +Common mistake + +- do not try to create entirely new organization with the new rules and situates scenario in this +- the results is simplification on the organization side +- the participants are forced to understand the rules you definied, e.g. fictious processes etc. instead of thinking about their own experiences and applying the knowledge they already possesed or discovering gaps in current procesess + +- na základÄ› zĂskanĂ˝ch informacĂ +- nynĂ tvoĹ™Ăme strukturu, v dalšà fázi do nĂ budeme pĹ™ipravovat obsah + +Definice cĂlĹŻ a dekomponovanĂ˝ch aktivit chovánĂ + - cĂle ve vztahu Trainee si majĂ procviÄŤit XY – specificky, komplexnÄ›jšĂ, urÄŤitá oblast, ... + aktivta_ podĹ™azenĂ© pod cĂl, dekomponovanĂ© a má projev platformÄ› + . z hlediska vyhodnocovánĂ +- pĹ™Ăklady! + projevy v platformÄ› .... jakĂ© jsou + co konkrĂ©tnÄ› s tĂm dÄ›lat –> bloom + zajĂmaá inspirace ukázat Ĺľe napsánĂ emialu mĹŻĹľe naplnit rĹŻznĂ© aktvity v bloomu – je to inspirace, nikoli dogma + + + - Injecty – co, tÄ›m lidem musĂme dát za informace/Ăşkoly + - pĹ™ ideifnici injectĹŻ se moĹľná znovu vrátĂme k aktivitám, ten proces nenĂ lineárnĂ + - poĹ™adĂ injectĹŻ + +- paralelnĂ cesty ... + +- dalšà role diff --git a/docs/INJECT_process/define/overview.md b/docs/INJECT_process/define/overview.md new file mode 100644 index 0000000000000000000000000000000000000000..4a00615901635373fbe7b2ab20e6e5f4de2f2ba5 --- /dev/null +++ b/docs/INJECT_process/define/overview.md @@ -0,0 +1,178 @@ +# DEFINE: clearly outline exercise essentials + +## In a nutshell + +- This is the second phase of the INJECT process, focused on defining clear exercise objectives. +- Involves breaking down objectives into specific learning activities and creating the main and parallel inject lines to form a cohesive scenario. +- Results in a well-structured scenario that guides the entire exercise. + +--- + +## Where are we in the INJECT process? + + + +--- + +!!! Disclaimer + At this part of the documentation, we will include a guide for the Editor. + However, please note that the Editor's functionalities are still undergoing extensive iteration. + As a result, this section is not currently included in the documentation. + +## 1. Define Learning Objectives and Activities + +### Learning Objectives (LO) + +A comprehensive goal of the exercise that addresses specific needs. +Learning objectives are derived from what participants should actually do during an incident or in a certain situation to handle it in the best possible way. +There can be multiple learning objectives in a single exercise, but we recommend a maximum of five. + +Examples: + +- LO1: Handling an incident in accordance with a defined process. +- LO2: Clear communication with all stakeholders. +- LO3: Making the right decision regarding contacting the OU and applying GDPR. +- LO4: Designing appropriate actions in response to the incident. +- LO5: Reflecting on the incident. + +### Learning Activities (LA) + +Learning Activity (LA): +The decomposition of learning objectives into individual, actionable tasks. +Each learning objective can have multiple learning activities, but we recommend a maximum of five. + +Examples: + +- LO1: Handling an incident according to a defined process. + - LA1.1: Conduct a correct analysis of the incident and request any missing information. + - LA1.2: Establish the incident in the ticketing system. + - LA1.3: Apply relevant parts of the incident handling manual, such as contacting management, PR, and the officer in charge. +- LO2: Clear communication with all stakeholders. + - LA2.1: Compose a brief email to management, outlining the minimum required information and next steps. + - LA2.2: Draft an email to the communications team highlighting potential communication risks. + - LA2.3: Ensure the email to the trainee is consistent with the requirements of the Initial Handling Manual. + +??? "Systematic Approach to Creating Learning Activities" + + ### 1. Platform Actions for Trainees + + Firstly, understand the possible actions trainees can perform on the platform: + + - Sending an email + - Using a tool + - Activating an interaction element (confirmation, decision, answering a questionnaire) + + ### 2. Bloom's Taxonomy Inspiration + + Secondly, combine these actions with various actionable verbs from Bloom's taxonomy to create interesting and diverse learning activities. + Bloom's taxonomy is a framework for categorizing educational goals and activities. + Here are some relevant verbs for tabletop exercises: + + - Identify + - Search + - Summarize + - Predict + - Decide + - Estimate + - Compare + - Examine + - Present + - Implement + - Act out + - Break down + - Argue + - Negotiate + - Criticize + - Reflect + - Review + - Write + - Solve + + #### Examples + + - **Example 1:** Suppose you choose an email as an action for the trainees. + Now, using the action words, you can realize that an email asking for a summary is different from one requiring a decision. + - Summarize: "Compose an email summarizing the incident details and the initial response actions." + - Decide: "Send an email deciding whether to escalate the incident to upper management." + - **Example 2:** Asking participants to make a decision via an email versus a specific questionnaire can lead to different outcomes and experiences. + - Email: "Draft an email explaining your decision on how to handle the data breach." + - Questionnaire: "Complete the questionnaire to decide the next steps in the data breach protocol." + + By systematically combining platform actions with Bloom's taxonomy verbs, you can design comprehensive and engaging training experiences. + + ### 3. Alignment with the learning objectives + + Thirdly, check that created activities are aligned with the defined learning objectives. + +## 2. Compose the Main Storyline + +Once you have defined the desired learning activities, you can begin creating your scenario. + +- **Define the Main Injects**: + Based on the needs, goals, learning activities, and information gathered during the understanding phase, identify the main injects that will drive the exercise. + +- **Align Injects with Learning Activities**: + Ensure that each inject aligns with the learning activities it is designed to drive. + Injects can take various forms and be delivered through different channels, such as emails, notifications, or simulated media. + +- **Avoid Overloading with Injects**: + It is not necessary to create an inject for every learning activity. + Often, a single inject about an incident can trigger multiple learning activities. + Focus on creating impactful injects that promote a series of related actions and decisions. + +- **Iterative Process**: + Be prepared to iterate. + You may need to step back and modify the learning activities or injects as you refine the scenario. + Flexibility and responsiveness to new insights are key to developing an effective exercise. + +### Designing Parallel Variants + +The INJECT Exercise Platform allows you to design "parallel" variants, enriching the exercise experience through conditional responses. +This means that at specific points in the exercise, the scenario can branch based on the trainee's actions. +Here’s how you can effectively design these variants: + +- Identify Key Decision Points: Determine the crucial moments in the exercise where trainees' decisions or actions could lead to different outcomes. + These points are where you can introduce parallel variants. +- Create Conditional Responses: Design responses that reflect the trainee's decisions. + These responses should be logical consequences of their actions, enhancing realism and engagement in the exercise. + +Examples: + +- Decision to Pay Ransom: + If a trainee decides to pay the ransom, the next inject will reflect this decision, potentially leading to new challenges or consequences. +- Failure to Contact PR Department: + If a trainee forgets to contact the PR department, they will receive a hint, nudging them to take the necessary action. + +## 3. Designing Add-on Storylines + +In addition to the main scenario, you can enhance the exercise by designing add-on storylines. +These additional elements are not crucial for achieving the primary learning objectives but can make the exercise more engaging and realistic. + +- **Identify Potential Add-ons**: + Think of scenarios or incidents that could logically occur alongside the main storyline. + These should be relevant but not essential to the primary objectives. + +Example: + +- Customer Reactions: + Introduce an add-on storyline where trainees receive angry emails from customers reacting to the accidental blocking of a legitimate website. + +## Final Remarks + +While the definition phase may appear straightforward, it is often a complex and iterative process. +You will find yourself continually refining learning activities and main storyline injects. + +However, don't be discouraged by the messiness of this phase. +With each scenario you define, the process becomes more streamlined and manageable. + +By the end of this phase, you will have developed an exercise scenario, which serves as the cornerstone for the preparation phase. +Remember, the effort invested in crafting a robust scenario will ultimately contribute to the success of the entire exercise. + +<div class="NAVIGATION" markdown> + [← 1 Understanding phase](../understand/overview.md){ .md-button } + [3 Preparation phase →](../prepare/overview.md){ .md-button } +</div> + +<div class="NAVIGATION" markdown> + [INJECT Process Overview](../intro/overview.md){ .md-button } +</div> diff --git a/docs/INJECT_process/define/storyline.md b/docs/INJECT_process/define/storyline.md new file mode 100644 index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 diff --git a/docs/INJECT_process/execute/checklist_execution.md b/docs/INJECT_process/execute/checklist_execution.md new file mode 100644 index 0000000000000000000000000000000000000000..09f246ce85fd6554cc7a148aa9cc5d54a3b92d39 --- /dev/null +++ b/docs/INJECT_process/execute/checklist_execution.md @@ -0,0 +1,3 @@ +# How to execute? Checklist + +TBD diff --git a/docs/INJECT_process/execute/guide_instructor.md b/docs/INJECT_process/execute/guide_instructor.md new file mode 100644 index 0000000000000000000000000000000000000000..a404429228f48cc7969ef5fe4d8aff4d0b67b9cf --- /dev/null +++ b/docs/INJECT_process/execute/guide_instructor.md @@ -0,0 +1,3 @@ +# Guide for Exercise instructors + +TBD diff --git a/docs/INJECT_process/execute/overview.md b/docs/INJECT_process/execute/overview.md new file mode 100644 index 0000000000000000000000000000000000000000..46885490fd604a0d06ff9568ed163d9e2a2236f8 --- /dev/null +++ b/docs/INJECT_process/execute/overview.md @@ -0,0 +1,76 @@ +# EXECUTE: conduct and manage the exercise + +## In a nutshell + +- This is the fourth phase of the INJECT process dedicated to managing and conducting the exercise. +- It includes facilitating the exercise, providing initial briefings, and conducting the final hot wash. +- Uses the INJECT Exercise Platform to ensure efficient execution and data collection. + +--- + +## Where are we in the INJECT process? + + + +--- + +## Final Checks + +- Conduct a walkthrough of the venue to ensure everything is in place. +- Verify all technical setups one last time. +- Confirm that all materials, equipment, and resources are ready and accessible. + +## Tasks for instructors + +As an exercise instructor, your role is crucial in ensuring the smooth execution of the tabletop exercise. +Here are some key tasks to keep in mind: + +- **Provide Initial Exercise Brief**: + Start by providing participants with an initial exercise brief, outlining the context, rules, and expectations for the exercise. + +- **Consider Platform Tutorial**: + If necessary, provide a tutorial on how to navigate and use the platform effectively, ensuring that participants are familiar with its features and functionalities. + You can use our introductory definition: + <div class="NAVIGATION" markdown> + [Introductory Definition](https://gitlab.fi.muni.cz/inject/definitions/introductory-definition){ .md-button } + </div> + +- **Monitor Trainee Activities**: + Keep a close eye on the activities of trainees throughout the exercise. + Ensure that they are engaged and progressing appropriately. + +- **Choose Appropriate Responses**: + One of the most important tasks is to choose appropriate responses to the actions of trainees. + For example, emails may have different response templates prepared for different situations. + It's essential to select the most suitable response to ensure that trainees do not get stuck. + +- **Utilize Role Play in Story**: + When nudging trainees, consider using role play within the story context. + Clever hints that suit the scenario context are often more effective than using your authority as an instructor. + +- **Be Prepared to Improvise**: + While much of your knowledge is embodied in response templates, + be prepared to improvise if the trainees' reactions are unexpected or deviate from the planned scenario. + +- **Provide Hot Wash**: + Finally, conduct a hot wash session after the exercise to + debrief participants, discuss key learnings, and provide feedback on their performance. + Also ask for their feedback on the scenario. + +- **Interview Instructors**: + After the hot wash session, conduct a group interview with the exercise instructors to gather their immediate feedback. + +!!! Disclaimer + In this part of the documentation, we will provide a guide for the Instructor View. + Nevertheless, it's important to note that + the complete user guide for the Instructor View is currently undergoing significant iteration. + Therefore, this section is not included at this time. + +<div class="NAVIGATION" markdown> + [← 3 INJECT Process overview](../prepare/overview.md){ .md-button } + [5 Definition phase →](../reflect/overview.md){ .md-button } +</div> + +<div class="NAVIGATION" markdown> + [INJECT Process Overview](../intro/overview.md){ .md-button } +</div> diff --git a/docs/INJECT_process/intro/overview.md b/docs/INJECT_process/intro/overview.md new file mode 100644 index 0000000000000000000000000000000000000000..3c0f86cf654434e29e83054dc3b28f1d2fef4684 --- /dev/null +++ b/docs/INJECT_process/intro/overview.md @@ -0,0 +1,148 @@ +# INJECT Process + +## In a nutshell + +- The INJECT process is a way to design tabletop security exercises with the INJECT Exercise Platform. +- It consists of five interconnected phases inspired by design thinking: + understand, define, prepare, execute, and reflect. +- The main advantage is that it incorporates the platform into the whole process. + +--- + +## Overview of the phases + + + +### 01 Understanding phase + +The goal of the Understanding phase is to gather all the necessary information to prepare for the exercise. +This includes identifying the objectives, the scope, and the resources required. +During this phase, you will ensure that you have a comprehensive understanding of the context and goals of the exercise. + +### 02 Definition phase + +In the Definition phase, you will clearly define the exercise objectives, aligning them with the needs identified in the previous phase. +This involves breaking down these objectives into specific learning activities and creating the main and parallel inject lines that form the scenario. +The primary outcome of this phase is a well-structured scenario that will guide the exercise. + +### 03 Preparation phase + +The Preparation phase focuses on getting everything ready for the exercise. +This includes preparing the content, setting up logistics, and ensuring that all materials and resources are in place. +The aim is to be fully prepared for a smooth and successful execution of the exercise. + +### 04 Execution phase + +The Execution phase is about managing the exercise day. +This includes facilitating the exercise, conducting initial briefings, and performing the final hot wash. +The INJECT Exercise Platform will be used extensively to support these activities, ensuring that the exercise runs efficiently. + +### 05 Reflection phase + +The Reflection phase is dedicated to evaluating the exercise on multiple levels. +This includes + +* assessing participant performance and providing specific recommendations, +* reviewing the scenario for potential improvements, and +* reflecting on the overall organization and execution of the exercise. + +This phase aims to identify strengths and areas for improvement, helping to enhance future exercises. + +??? "Relation to INJECT Exercise Platform Components:" + ### Editor + + The Editor is a versatile tool used during the **Definition and Preparation phases** of the INJECT Process. + It allows exercise designers to define exercise objectives, create scenarios, and prepare exercise content. + With its user-friendly interface, the Editor enables efficient scenario development and content organization. + + ### Trainee View + + The Trainee View is designed for use during the **Execution phase** of the exercise. + It provides trainees with access to the exercise scenario and injects, facilitating their participation and engagement. + Through the Trainee View, participants can navigate the exercise, respond to injects, and collaborate with teammates in a simulated environment. + + ### Instructor View + + The Instructor View is a comprehensive tool used by exercise instructors during the **Execution phase** of the exercise. + It allows instructors to manage the entire exercise, from overseeing participant interactions to facilitating discussions and providing guidance. + With features for real-time monitoring and intervention, the Instructor View ensures smooth exercise execution and effective facilitation. + + ### Analyst View + + The Analyst View serves multiple purposes throughout the INJECT Process. + During the **Reflection phase**, it is utilized for evaluation and data analysis, providing insights into participant performance and exercise outcomes. + Additionally, the Analyst View serves as a source of information during the **Understanding phase**, offering valuable data and feedback to inform exercise preparation. + Its intuitive interface enables thorough evaluation and informed decision-making for future exercises. + +## Subjects in the INJECT Process + +**In organizing a tabletop exercise, various functions are crucial to ensure its success. +Depending on the context, these functions may overlap, with some individuals taking on multiple responsibilities.** + +- **Client**: + The client is the organization or part of the organization for which the exercise is prepared and executed. + Ideally, the client understands the purpose and need for the exercise. + +- **Exercise Provider**: + This is the organization or department that oversees the entire process and appoints the exercise organizers. + +- **Exercise Organizers**: + These individuals are responsible for all aspects of preparation, including managing logistics and content preparation. + They act as the project managers of the exercise. + +- **Exercise Designers**: + Their main role is to develop the exercise scenario. + This includes defining the entire scenario and preparing the content for the platform. + They are the authors of the exercise concept. + +- **Exercise Instructors**: + These individuals execute the exercise via the platform, provide briefings, and conduct the final hot wash. + Unless specified otherwise, they also analyze the final data from the exercise. + +- **Exercise Participants** + These are the individuals who take part in the exercise. + Their primary objective is to learn and gain experience from the exercise. + +!!! NOTE + We distinguish between the subjects of the exercise (organizations, designers, instructors) and + the exercise roles intended for the scenario (e.g., CSIRT, lawyer, PR specialist, national authority). + +## Types of exercises + +**The INJECT process is designed to guide you through organizing a successful tabletop exercise using the INJECT Exercise Platform. +There are two primary types of exercises you can consider:** + +- **Process-Technical Exercises**: + These exercises focus on simulating specific processes using designated tools. + They are ideal for honing technical skills and ensuring that participants are proficient in particular procedures and systems. + +- **High-Level Strategic Exercises**: + These exercises emphasize decision-making, evaluation, and high-level planning. + They are suited for testing strategic thinking and the ability to manage and respond to complex scenarios. + +While these categories provide a useful framework, it is not necessary to adhere strictly to one type. +In fact, exercise designers are encouraged to blend both approaches. +By combining process-technical elements with strategic decision-making components, +you can create a more comprehensive and effective exercise tailored to your specific goals. + +## Start now + +<br> +<div class="result" markdown> + <div class="grid cards" markdown> +- [1. Understand](../understand/overview.md) +- [2. Define](../define/overview.md) +- [3. Prepare](../prepare/overview.md) +- [4. Execute](../execute/overview.md) +- [5. Reflect](../reflect/overview.md) +- [Glossary](../../glossary-of-terms.md) + </div> +</div> + +!!! Disclaimer + This is the initial version of the documentation describing the INJECT process from a broad perspective. + As we continue to develop the platform, we will expand each section with specific information and examples. + +<div class="NAVIGATION" markdown> + [Home](../../index.md){ .md-button } +</div> diff --git a/docs/INJECT_process/prepare/exercise_content.md b/docs/INJECT_process/prepare/exercise_content.md new file mode 100644 index 0000000000000000000000000000000000000000..fabbcc9271c32cd245e7839eb756562b1d3dfecf --- /dev/null +++ b/docs/INJECT_process/prepare/exercise_content.md @@ -0,0 +1,3 @@ +# Content creation + +TBD diff --git a/docs/INJECT_process/prepare/exercise_logistics.md b/docs/INJECT_process/prepare/exercise_logistics.md new file mode 100644 index 0000000000000000000000000000000000000000..c9f62d0c45fc1d1faf88474b6857017e28590143 --- /dev/null +++ b/docs/INJECT_process/prepare/exercise_logistics.md @@ -0,0 +1,3 @@ +# Exercise logistics checklist + +TBD diff --git a/docs/INJECT_process/prepare/overview.md b/docs/INJECT_process/prepare/overview.md new file mode 100644 index 0000000000000000000000000000000000000000..680a140d3eadebe7016b614b3a0ca56980749172 --- /dev/null +++ b/docs/INJECT_process/prepare/overview.md @@ -0,0 +1,146 @@ +# PREPARE: get everything ready for the exercise + +## In a nutshell: + +- This is the third phase of the INJECT process, aimed at preparing all necessary content and logistics. +- Ensures that all materials, resources, and logistical arrangements are in place for a smooth execution. +- Prepares everything needed for a successful and efficient exercise day. + +--- + +## Where are we in the INJECT process? + + + +## Exercise Content creation + +This part of preparation involves filling the structure of the defined scenario with concrete text, pictures, other media, or logical rules. +In this phase, you will prepare the content for injects such as emails, files, questionnaires, and tools. +You will also set up details for the learning activities of the trainees. + +The preferred method for content creation in the future is using the Editor, an INJECT Exercise Platform component that is currently in the prototype stage. +However, there is an alternative option available: you can prepare content directly by creating and editing YAML files. + +??? "How to prepare content in YAML?" + + ## General Remarks + + - Start with Examples: First of all, check the examples of definitions in GitLab. + It is a great starting point. + + <div class="NAVIGATION" markdown> + [INJECT Definition Examples](https://gitlab.fi.muni.cz/inject/backend/-/tree/main/definitions?ref_type=heads){ .md-button } + </div> + + - Iterate and Test: Iterate and test a lot to ensure the content is accurate and functional. + - Most of the typos and errors in the YAML format are caught by the validator in the platform. + - Markdown for Complex Texts: If there are any longer or more complex texts or responses (especially those with special characters), it is recommended to use markdown files in the content folder. + + ## Crucial Concepts + + ### Injects and Inject Categories and Inject Selections + + A core idea the exercise definition is built on is that an inject category (IC) groups injects, for which it only makes sense to send one of them to the team. + These can, for example, be variations of the same inject, where one is sent if condition A is met and B is sent, then the condition is not met. + Inject categories can either be evaluated and sent to the team automatically or manually by an instructor. + In case the injects are evaluated manually by an instructor, they transform from an IC into an inject selection (IS). + With the IS in hand, an instructor can select any of the injects in it and forward them to the trainees. + They may also change the inject in any way before actually sending it to the team, so in case some information is not known at the time of creating the definition and cannot be specified as the inject condition, you can add a message for the instructor into the inject itself, something like "...send email to [INSTRUCTOR EDIT HERE] and...". + Just make sure to tell this to the instructors, as if they do not edit this and select the inject, it will be sent as is, breaking the immersion for the trainees. + + ### Conditional Injects + + As described in the exercise definition repository, adding multiple injects into one inject category (IC) produces conditional injects, which may be sent based on a specific situation happening in the scenario. + This may be used to create branching in the scenario, or just to make the exercise feel more responsive and realistic, where actions of trainees have notable consequences and impact on how the scenario plays out. + + ### Milestones + + Milestones are an element that connects the entire exercise definition together. + Each team has its own set of milestones to reach independently of other teams. + They define interactions between injects, tools, and emails. + Whenever there is an action that is supposed to produce a response from the application, whether automated or semi-automated, a milestone must be linked to this action and the corresponding response. + If the usage of tool is supposed to have an impact on an exercise, a milestone has to be linked to this tool usage and to the impact. + They are by default invisible to trainees, but instructors see them and can use them to evaluate the state of each team. + A set of all milestones the team has reached clearly identifies the point of the exercise this team is in. + + ### Email Tool + + An email tool is used for simulating conversations between trainees and other entities in the exercise. + As an exercise may be rather complicated, the instructor may not know there exact details about each of the correspondents they are supposed to act as. + For this reason, you may use the description field of each address in email.yml to clearly explain to the instructor what the purpose of each correspondent is. + If the corespondent is expected to react a certain way to certain situations, use templates. + These give instructor pre-scripted email choices + +!!! Disclaimer + At this part of the documentation, we will include a guide for the Editor. + However, please note that the Editor's functionalities are still undergoing extensive iteration. + As a result, this section is not currently included in the documentation. + +??? "How to make exercise more fun?" + + ## TECHNIQUES – TBD + + - gamification + - offline aspects + - emotions + - strong story + +## Exercise logistics + +??? "General Checklist" + + ### Venue Arrangements + + - Book the exercise location. + - Ensure the venue has necessary facilities (e.g., Wi-Fi, power outlets, seating arrangements). + - Confirm availability of AV equipment (projectors, screens, microphones). + + ### Instructors + + - Instructors are key to the implementation of the exercise. + - In the basic model we need one instructor per team. + - Specialists? Not needed - their knowledge is embodied in the response templates. + - If the instructors are not experienced you should have a dry run with them. + + ### Equipment and Materials + + - Prepare and test all necessary equipment (computers, tablets, printers). + - Ensure backup equipment is available. + - Print all required physical materials. + + ### Communication Plan + + - Confirm contact information for all participants, instructors, and support staff. + - Prepare and schedule pre-exercise communications (reminders, agendas). + + ### Participant Readiness + + - Distribute pre-exercise materials and instructions to participants. + - Schedule a pre-exercise briefing session if necessary. + - Ensure participants have completed any required pre-exercise training or assessments. + + ### Logistics Coordination + + - Confirm catering arrangements, if applicable. + - Arrange transportation and accommodation for participants and staff, if necessary. + - Ensure all logistical support staff are briefed and understand their roles. + +??? "Platform Setup" + - Ensure that exercise definition is ready. + - Test it in the platform. + - We suggest to organize a dry run at the end of the Prepation phase. + + ### User onboarding + + !!! TBD + Please note that a comprehensive guide for the creation of accounts will be developed in the coming months. + Stay tuned for detailed instructions on this process. + +<div class="NAVIGATION" markdown> + [← 2 Definition phase](../define/overview.md){ .md-button } + [4 Execution phase →](../execute/overview.md){ .md-button } +</div> + +<div class="NAVIGATION" markdown> + [INJECT Process Overview](../intro/overview.md){ .md-button } +</div> diff --git a/docs/INJECT_process/reflect/organization.md b/docs/INJECT_process/reflect/organization.md new file mode 100644 index 0000000000000000000000000000000000000000..144ed4cfd7567ec3bceb81e626cee7f87237423b --- /dev/null +++ b/docs/INJECT_process/reflect/organization.md @@ -0,0 +1,3 @@ +# Organisation + +- co mÄ›lo bĂ˝t lepšà diff --git a/docs/INJECT_process/reflect/overview.md b/docs/INJECT_process/reflect/overview.md new file mode 100644 index 0000000000000000000000000000000000000000..1641d0533ae889cdf3342d7bbf5ab513926f3e02 --- /dev/null +++ b/docs/INJECT_process/reflect/overview.md @@ -0,0 +1,54 @@ +# REFLECT: evaluate and improve the exercise + +## In a nutshell: + +- This is the fifth phase of the INJECT process, aimed at evaluating the exercise on multiple levels. +- Focuses on assessing participant performance, reviewing the scenario, and reflecting on the overall organization and execution. +- Provides specific recommendations for improvements and identifies strengths to enhance future exercises. + +--- + +## Where are we in the INJECT process? + + + +--- + +## Participant Performance Evaluation + +- Reflect on how participants performed based on the established learning objectives and activities. +- Analyze both individual and group performance throughout the exercise. +- Recognize areas where participants excelled and demonstrated competency. +- Highlight aspects where participants faced challenges or showed gaps in understanding. + +### Provide recommendations for improvement + +- Offer clear recommendations for enhancing participant performance in relation to the exercise objectives. +- Suggest practical insights for addressing identified weaknesses and leveraging strengths. + +!!! Disclaimer + In this part of the documentation, we will offer a guide for the Analyst View. + However, please be aware that the comprehensive guide to its usage is still undergoing substantial revisions. + Consequently, this section is not currently featured in the documentation. + +## Scenario Review + +- Recognize any shortcomings or areas for improvement within the scenario. +- Consider feedback from participants and facilitators on areas that could be strengthened. +- Propose specific changes or additions to the scenario to enhance realism, engagement, and learning outcomes. + +## Organization and execution reflection + +- Reflect on the effectiveness of organizational processes in planning and executing the exercise. +- Document best practices and strategies for improving future exercise planning and implementation. + +## Final Remarks + +Never overlook the importance of the reflection phase. +It serves as an input for your next understanding phase when planning another exercise. +Remember, the knowledge gained from one reflection can directly impact your next exercises. + +<div class="NAVIGATION" markdown> + [← 4 Execution process](../execute/overview.md){ .md-button } + [INJECT Proces overview](../intro/overview.md){ .md-button } +</div> diff --git a/docs/INJECT_process/reflect/participants.md b/docs/INJECT_process/reflect/participants.md new file mode 100644 index 0000000000000000000000000000000000000000..6c5ab158bf22cfd88f161691977b41fcdfa2ba58 --- /dev/null +++ b/docs/INJECT_process/reflect/participants.md @@ -0,0 +1,9 @@ +# participants + +- jak se jim podaĹ™ilo dááshonout aktivt a cĂlĹŻ + milnĂky vidĂme okamĹľitÄ› + kvalita + + Hot wash + + After action recommendation diff --git a/docs/INJECT_process/reflect/scenario.md b/docs/INJECT_process/reflect/scenario.md new file mode 100644 index 0000000000000000000000000000000000000000..24be0c98fec31ccee3208adfb069b2b2c44d33f1 --- /dev/null +++ b/docs/INJECT_process/reflect/scenario.md @@ -0,0 +1,6 @@ +#reflect scenario + +- co bylo problematickĂ© v obsahu + - sbĂránĂ zpÄ›tnĂ© vazby + . otázky z dotaznĂkĹŻ + - the fact the participant didn't like something in the scenario, felt confused or under the pressure does'not necessary mean that hte scenario is bad -> always bear in mind the overall learning objectives and learning activities that you've definied with clear purpose. diff --git a/docs/INJECT_process/understand/overview.md b/docs/INJECT_process/understand/overview.md new file mode 100644 index 0000000000000000000000000000000000000000..a7c7b6204c8b3b8903fd1301c795954265d88b04 --- /dev/null +++ b/docs/INJECT_process/understand/overview.md @@ -0,0 +1,125 @@ +# UNDERSTAND: get all the information you need + +## In a nutshell: + +- This is the first phase of the INJECT process. + Its goal is to understand everything needed for successful exercise preparation. +- It starts with an initial workshop to bring everyone together and get as much done as possible. +- We will give you specific recommendations on how to manage the entire phase. + +--- + +## Where are we in the INJECT process? + + + +--- + +## Initial workshop + +Once the decision to hold a tabletop exercise is made, we propose conducting an initial workshop as soon as possible. + +- Participants should include representatives from both the organizing team and the client's side. +- We recommend a set of actions and methods to structure the workshop effectively. +- The workshop will facilitate information sharing, establish collaboration, make decisions, and create a clear roadmap for the next steps. + +TIP: Don't forget to appoint someone to moderate the workshop and someone to write down all the important details. + +### 1. Discuss the exercise essentials + +#### Clarify the basics + +Once you've broken the ice, proceed straight to the essential facts about the exercise. +Follow a structured approach by employing the following list of five questions. + +??? "5 questions" + 1. When should the exercise take place? Consider that the exercise date will impact subsequent actions, so it's essential to establish it early on. + 2. Identify the target audience of the exercise. + 3. Determine the main objective of the exercise. + 4. Decide where the exercise should be thematically positioned. + Although this can be refined later, it's important to have an initial understanding. + For instance, designing an exercise for decision-makers in a fictional scenario differs from one tailored for the CSIRT of a client's organization. + 5. Consider how the exercise should be structured. + While detailed specifications will come later, begin gathering ideas on injects to include or preferred storyline. + +#### Understand the genuine needs + +Need is the reason why the client chooses to exercise. +**It's about connecting the exercise to what the client really wants to achieve**. +Usually, it's about protecting the organization's stuff, like money and reputation. +But by understanding the client's needs better, you might find out they want something more specific. +Like if their rival gets hit by a cyber attack, they want to make sure they're ready for the same thing. +Or maybe they want to learn from incidents that happened before. + +*Example: our organization needs to properly handle data leakage incidents to avoid penalties and reputational risk that would lead to potential loss of profits.* + +The organizational team must pinpoint the client's needs precisely. +**This way, we can make sure the exercise's learning objectives hit the mark**. +One good way to dig deeper is by using the 5 Whys method. + +??? "5 Whys method" + Let's kick off with a question: "Why is the exercise necessary?" + + - Jot down the answer, then ask "Why?" again. + - Repeat this process, noting down each subsequent answer and asking "Why?" again, at least for the next four rounds. + - After this, determine if you've uncovered any new insights that might impact the next exercise preparation. + +#### Determine the preferred setup for the exercise + +Different setups offer unique requirements and possibilities that will influence next phases. +Here are the main options: + +- **Teams with Single Laptops:** + This setup is ideal for process-technical exercises where coordination and collaboration among team members are crucial. + Each team member has their own laptop, allowing for individual work as well as seamless communication and coordination within the team. + +- **One Big Screen for Team**: + Alternatively, this setup is better suited for high-level strategic exercises that focus on policy and strategic decision-making. + Instead of individual laptops, the team gathers around one big screen, enabling a centralized view of information and fostering discussion and collaboration among team members. + +Variations of these setups can be explored to tailor the exercise experience to the needs. + +### 2. Further Recommendations for Initial Workshop + +Once you've discussed the essentials of the exercise, take advantage of having most of the key people in the room. +Focus on the following actions: + +- **Brainstorm Inputs**: + Identify and list all the inputs you will need from the client or third parties. + This may include: + + - Email addresses to be used in the exercises + - Relevant policies and documents + - Pictures and logos etc. + - Names of departments and key personnel (if relevant for intended scenario) + - Any other specific information required by the scenario + +- **Establish Cooperation Methods:** + Determine your communication channels, methods for sharing information, and develop a roadmap for next steps and future meetings. + +- **Assign Tasks:** + Clarify the follow-up tasks that need to be completed. + Assign these tasks to specific individuals with concrete deadlines. + +- **Circulate Follow-Up:** After the meeting, circulate a follow-up summary to all attendees to ensure everyone is on the same page. + +TIP: Be proactive and flexible. +It's not always possible to organize meetings with everyone present. +Don't wait for full attendance—test and discuss your work in shorter intervals with those available. + +## Understanding phase after the workshop + +After the initial workshop, the Understanding phase continues with the exercise designers diving deeper into the topic and exploring possibilities for the tabletop scenario. +The next steps are heavily influenced by the information gathered during the initial workshop. +Designers should leverage this data to refine their approach. + +- **Research and Exploration:** + Exercise designers thoroughly investigate the topic, exploring various angles and potential scenarios that align with the exercise objectives. +- **Regular Communication:** + Maintain regular communication with the client to ensure the evolving scenario aligns with their needs. + This ongoing dialogue helps shape the overall direction and ensures that the exercise remains relevant and targeted. + +<div class="NAVIGATION" markdown> + [← INJECT Proces overview](../intro/overview.md){ .md-button } + [2 Definition phase →](../define/overview.md){ .md-button } +</div> diff --git a/docs/glosary-of-terms.md b/docs/glosary-of-terms.md deleted file mode 100644 index b5a62cec388a6f8b429079768053ad7a7a7788ed..0000000000000000000000000000000000000000 --- a/docs/glosary-of-terms.md +++ /dev/null @@ -1,14 +0,0 @@ -## Tabletop Exercise (TTX) -A tabletop exercise (TTX) is a type of teaching activity designed to train professional teams in incident response to a crisis situation. The simulated crisis happens in the context of business operations in an organization, such as a phishing attack on employees or malware infecting the company infrastructure. The team members, who hold various roles in the organization (e.g., manager or cybersecurity incident responder), discuss which actions to take to effectively respond to the emergency while following proper protocols and regulations. These discussions are facilitated by instructors, who also present an exercise debriefing at the end. TTXs are an effective educational tool that enhance incident preparedness, particularly in communication, coordination, and collaboration. - -## INJECT Exercise Platform (IXP) -The INJECT Exercise Platform (IXP) is an interactive web application designed to support the delivery and evaluation of TTXs. Designers use the platform to instantiate an exercise definition, which prescribes the exercise story, injects, available tools, and milestones. An exercise definition is implemented as a set of structured text-based files (in YAML format) that are both human- and machine-readable. IXP automates a substantial portion of the TTX by providing trainees with tools and inject response templates, significantly reducing the workload and personnel requirements for TTX delivery. - -## Inject -An inject is a pre-scripted message, such as an email, provided to trainees during a Tabletop Exercise (TTX). Its purpose is to move the scenario forward and prompt additional actions. For example, an inject can inform the trainees about a data breach in their company, requiring them to respond accordingly. [NIST] (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-84.pdf) - -## Tool -A tool is a simplified simulated version of a real-world computer application or service. Its purpose is to allow trainees to perform actions to respond to injects. For instance, instead of using an actual email client, trainees use an “email” tool to send and receive in-exercise messages. Another example is a “browser” tool that returns an in-exercise website based on the provided exercise URL. - -## Milestone -A milestone is a true/false condition that denotes whether a specific team reached a certain important situation in the TTX scenario. Its purpose is to track each team’s progress through the TTX. For example, it can mark that a team used an email tool to respond to a query from a manager. The exercise milestones can be completed in any order, and there is rarely a single correct solution, which makes team assessment challenging. diff --git a/docs/glossary-of-terms.md b/docs/glossary-of-terms.md new file mode 100644 index 0000000000000000000000000000000000000000..529dc623676525ffb1fdfa51e5408cf587bbd0e2 --- /dev/null +++ b/docs/glossary-of-terms.md @@ -0,0 +1,98 @@ +# Glossary of terms + +This section offers easy-to-understand explanations of important terms and concepts used in tabletop exercises and the INJECT Exercise Platform, +helping you navigate through exercise preparations and discussions with confidence. + +## Basics + +Tabletop Exercise, TTX +: a type of teaching activity designed to train professional teams in incident response to a crisis situation. + The simulated crisis happens in the context of business operations in an organization, such as a phishing attack on employees or malware infecting the company infrastructure. + The team members, who hold various roles in the organization (e.g., manager or cybersecurity incident responder), discuss which actions to take to effectively respond to the emergency while following proper protocols and regulations. + These discussions are facilitated by instructors, who also present an exercise debriefing at the end. + TTXs are an effective educational tool that enhance incident preparedness, particularly in communication, coordination, and collaboration. + +INJECT Exercise Platform, IXP +: The INJECT Exercise Platform (IXP) is an interactive web application designed to support the delivery and evaluation of TTXs. + Designers use the platform to instantiate an exercise definition, which prescribes the exercise story, injects, available tools, and milestones. + An exercise definition is implemented as a set of structured text-based files (in YAML format) that are both human- and machine-readable. + IXP automates a substantial portion of the TTX by providing trainees with tools and inject response templates, significantly reducing the workload and personnel requirements for TTX delivery. + +INJECT +: a pre-scripted message, such as an email, provided to trainees during a Tabletop Exercise (TTX). + Its purpose is to move the scenario forward and prompt additional actions. + For example, an inject can inform the trainees about a data breach in their company, requiring them to respond accordingly. + [NIST](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-84.pdf). + +Definition +: This term refers to a complete scenario that has been incorporated into the required format for the platform, specifically using YAML files. + Such a definition can be downloaded as a zip file and then launched as an exercise on the platform. + +Hot Wash +: a post-exercise discussion or debriefing session where participants and facilitators provide immediate feedback and reflections on the exercise. + It allows for real-time analysis and identification of strengths and areas for improvement. + +Tool +: a simplified simulated version of a real-world computer application or service. + Its purpose is to allow trainees to perform actions to respond to injects. + For instance, instead of using an actual email client, trainees use an “email” tool to send and receive in-exercise messages. + Another example is a “browser” tool that returns an in-exercise website based on the provided exercise URL. + +Milestone +: a true/false condition that denotes whether a specific team reached a certain important situation in the TTX scenario. + Its purpose is to track each team’s progress through the TTX. + For example, it can mark that a team used an email tool to respond to a query from a manager. + The exercise milestones can be completed in any order, and there is rarely a single correct solution, which makes team assessment challenging. + +## Exercise subjects + +Exercise Organizers +: These individuals are responsible for all aspects of preparation, including managing logistics and content preparation. + They act as the project managers of the exercise. + +Exercise Designers +: Their main role is to develop the exercise scenario. + This includes defining the entire scenario and preparing the content for the platform. + They are the authors of the exercise concept. + +Exercise Instructors +: These individuals execute the exercise via the platform, provide briefings, and conduct the final hot wash. + Unless specified otherwise, they also analyze the final data from the exercise. + +Exercise Participants +: These are the individuals who take part in the exercise. + Their primary objective is to learn and gain experience from the exercise. + +Exercise Provider +: This is the organization or department that oversees the entire process and appoints the exercise organizers. + +Client +: the organization or part of the organization for which the exercise is prepared and executed. + Ideally, the client understands the purpose and need for the exercise. + +## Components of the platform + +Editor +: a **future (currently prototyped)** INJECT Exercise Platform Component. + It is a versatile tool used during the Definition and Preparation phases of the INJECT Process. + It allows exercise designers to define exercise objectives, create scenarios, and prepare exercise content. + With its user-friendly interface, the Editor enables efficient scenario development and content organization. + +Trainee View +: The Trainee View is an INJECT Exercise Platform Component. + It is designed for use during the Execution phase of the exercise. + It provides trainees with access to the exercise scenario and injects, facilitating their participation and engagement. + Through the Trainee View, participants can navigate the exercise, respond to injects, and collaborate with teammates in a simulated environment. + +Instructor View +: The Instructor View is an INJECT Exercise Platform Component. + It is a comprehensive tool used by exercise instructors during the Execution phase of the exercise. + It allows instructors to manage the entire exercise, from overseeing participant interactions to facilitating discussions and providing guidance. + With features for real-time monitoring and intervention, the Instructor View ensures smooth exercise execution and effective facilitation. + +Analyst View +: The Analyst View is an INJECT Exercise Platform Component. + It serves multiple purposes throughout the INJECT Process. + During the Reflection phase, it is utilized for evaluation and data analysis, providing insights into participant performance and exercise outcomes. + Additionally, the Analyst View serves as a source of information during the Understanding phase, offering valuable data and feedback to inform exercise preparation. + Its intuitive interface enables thorough evaluation and informed decision-making for future exercises. diff --git a/docs/images/.DS_Store b/docs/images/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..0ace6253329615dc24cebd0020a4ddd5577fa73b Binary files /dev/null and b/docs/images/.DS_Store differ diff --git a/docs/images/00.png b/docs/images/00.png new file mode 100644 index 0000000000000000000000000000000000000000..ce9e2928e95eea1c14915a5eac7c78af8e20265d Binary files /dev/null and b/docs/images/00.png differ diff --git a/docs/images/01.png b/docs/images/01.png new file mode 100644 index 0000000000000000000000000000000000000000..03267cd530a0222f3d403e41c25a0dbf8bf8e31a Binary files /dev/null and b/docs/images/01.png differ diff --git a/docs/images/02.png b/docs/images/02.png new file mode 100644 index 0000000000000000000000000000000000000000..1c9bcc78fb90f23bad8a0ddc14dfb44b08de6b03 Binary files /dev/null and b/docs/images/02.png differ diff --git a/docs/images/03.png b/docs/images/03.png new file mode 100644 index 0000000000000000000000000000000000000000..fd6e43cbff8d592ce853a49c7d78480ed4d2b5ae Binary files /dev/null and b/docs/images/03.png differ diff --git a/docs/images/04.png b/docs/images/04.png new file mode 100644 index 0000000000000000000000000000000000000000..52b1c80fc784a3d264b178406e51a3076599b8aa Binary files /dev/null and b/docs/images/04.png differ diff --git a/docs/images/05.png b/docs/images/05.png new file mode 100644 index 0000000000000000000000000000000000000000..c5adb5c6047bba4e4809ba2677d19684a5faa1d5 Binary files /dev/null and b/docs/images/05.png differ diff --git a/docs/images/inject-logo--vertical-black.png b/docs/images/inject-logo--vertical-black.png new file mode 100644 index 0000000000000000000000000000000000000000..8fad590a7844d595ec41cc3e3216eea88543f71c Binary files /dev/null and b/docs/images/inject-logo--vertical-black.png differ diff --git a/docs/index.md b/docs/index.md index 4040d31ba6370c47f120f51cde1317c4f2f1771f..64d9290298711fa15f34f51c8980140d4fc60085 100644 --- a/docs/index.md +++ b/docs/index.md @@ -25,7 +25,7 @@ Learn about the process of conducting tabletop exercises using the INJECT Exerci Access supplementary materials and information related to INJECT Exercise Platform. -- **[Glossary of Terms](glosary-of-terms.md)**: Definitions of key terms and concepts used in the INJECT Exercise Platform. +- **[Glossary of Terms](glossary-of-terms.md)**: Definitions of key terms and concepts used in the INJECT Exercise Platform. - **[Report Bugs](report-bugs.md)**: Instructions for reporting bugs, issues, or providing feedback on the INJECT Exercise Platform. - **[Acknowledgements](acknowledgements.md)**: Recognition of individuals or organizations that have contributed to the development or support of the INJECT Exercise Platform. -- **[Authors](authors.md)**: Meet the team behind the development of INJECT Exercise Platform. \ No newline at end of file +- **[Authors](authors.md)**: Meet the team behind the development of INJECT Exercise Platform. diff --git a/docs/stylesheets/extra.css b/docs/stylesheets/extra.css index 55e4b9c4e0824a71aab1c11721e8c98bf9f76e4c..d7e47a10163bfc341c962254083758ef8289791a 100644 --- a/docs/stylesheets/extra.css +++ b/docs/stylesheets/extra.css @@ -28,6 +28,7 @@ --md-typeset-ins-color: #121212; --md-typeset-del-color: #121212; --md-typeset-mark-color: #ffdc4e85; + --md-admonition-fg-color: #ffdd4e; } :root > * { @@ -178,6 +179,34 @@ tr td { vertical-align: middle !important; } +.md-typeset .admonition, .md-typeset details { + border-color: #ffdd4e !important; + font-size: large; + color: white; + background-color: #121212; +} + +.md-typeset .admonition-title::before, .md-typeset summary::before { + display: none; + width: 0px; +} + +.md-typeset .admonition-title, .md-typeset summary { + padding-left: 0.75rem !important; + background-color: #fdd32b15 !important; + font-size: x-large; + color: #ffdd4e; +} + +.NAVIGATION { + display: flex; + justify-content: center; + align-items: center; +} + +.md-typeset .md-button { + margin: 0 30px; +} .container { display: flex; align-items: center; diff --git a/docs/tech/installation/back-README.md b/docs/tech/installation/back-README.md new file mode 100644 index 0000000000000000000000000000000000000000..faa02389bcad54ffd20e5111153c3e24ec093d3a --- /dev/null +++ b/docs/tech/installation/back-README.md @@ -0,0 +1,54 @@ +### Local variables + +- `INJECT_DEBUG`: _boolean, default=false_ - Run the backend in debug mode. **Do not set in production.** +- `INJECT_HOST_ADDRESSES`: _string, default=localhost_ - A comma-separated list of allowed hosts. +- `INJECT_CORS_ALLOWED_ORIGINS`: _string, default=http://localhost_ - A comma-separated list of origins (domains) that are authorized to make cross-site HTTP requests. +- `INJECT_NOAUTH`: _boolean, default=false_ - If set, authorization is turned off. +- `INJECT_EMAIL_HOST`: _string, default=""_ - SMTP server address. +- `INJECT_EMAIL_PORT`: _int, default=25_ - Port to use for the SMTP server defined in INJECT_EMAIL_HOST. +- `INJECT_EMAIL_HOST_USER`: _string, default=""_ - Username to use for authentication to the SMTP server defined in _INJECT_EMAIL_HOST_. +- `INJECT_EMAIL_HOST_PASSWORD`: _string, default=""_ - Password to use for the SMTP server defined in _INJECT_EMAIL_HOST_. This setting is used in conjunction with _INJECT_EMAIL_HOST_USER_ when authenticating to the SMTP server. +- `INJECT_EMAIL_SENDER_ADDRESS`: _string, default=""_ - The sender address for automatic emails. +- `INJECT_LOGS`: _string, default=backend-logs.log_ - Path to a file where to save logs. +- `INJECT_DOMAIN`: _string, default=""_ - Domain where yours instance of the INJECT is available. + + + +### Running the Application with Docker: +There is a `Dockerfile` present in this repository, which can be used to build an image of the current version of the backend. +Image can be built with this command: +```bash +docker build -t backend . +``` +Once the image is created, you can start the container with this command: +```bash +docker run --name backend -p8000:8000 -d backend gunicorn +``` +You can access the backend the way described in the same way as when running locally. + +Image allows running of unit tests as well, this can be done via: +```bash +docker run --rm backend test +``` + + +## Deployment +The backend is made to be deployed using [gunicorn](https://gunicorn.org/) with [uvicorn](https://www.uvicorn.org/) workers. +Specific versions of these servers are included in the poetry environment. +To start the server, run this one-line command: +``` +poetry python -m gunicorn ttxbackend.asgi:application -k uvicorn.workers.UvicornWorker +``` + +This will start a gunicorn server using uvicorn workers. `uvicorn` is required because `gunicorn` +does not support websockets, which are necessary for GraphQL subscriptions. + +Currently, it is not recommended to use **more than 1 worker**. + +An additional environment variable `HOST_ADDRESSES` must be set with a comma-separated list of +allowed host addresses. + +In Docker this can be done followingly: +```bash +docker run --name backend -e HOST_ADDRESSES="172.26.0.1,192.168.0.1" -p8000:8000 -d backend gunicorn +``` \ No newline at end of file diff --git a/docs/tech/installation/front-README.md b/docs/tech/installation/front-README.md new file mode 100644 index 0000000000000000000000000000000000000000..7975394bddff85e77469c944a703471feea71fa3 --- /dev/null +++ b/docs/tech/installation/front-README.md @@ -0,0 +1,21 @@ +### Docker deployment + +The repository has a prepared Dockerfile so you can build the image: + +``` +docker build . -t inject-fe +``` + +Run the following command to deploy the docker container: + +``` +docker run -p 80:80 inject-fe +``` + +During runtime of the container it's required to bind the container to a given `backend` instance: + +``` +docker run -p 80:80 -e VITE_HTTP_HOST=secure-be.inject.muni.cz -e VITE_HTTP_WS=wss://secure-be.inject.muni.cz/ttxbackend/v1/graphql inject-fe +``` + +Please keep in mind that changing environment variables requires restarting the container if done during runtime. \ No newline at end of file diff --git a/frontend b/frontend index 3781cb057acf5a305ba675cce25bfabfee4e2061..6094423282207f6a198c18334aef905662eccc03 160000 --- a/frontend +++ b/frontend @@ -1 +1 @@ -Subproject commit 3781cb057acf5a305ba675cce25bfabfee4e2061 +Subproject commit 6094423282207f6a198c18334aef905662eccc03 diff --git a/mkdocs.yml b/mkdocs.yml index c2ba7271770130ff4a21e315beeb81e7dba4c3a7..ad29d617358811e3d21afbd296edbf1befc8a46f 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -26,8 +26,21 @@ nav: - Overview: tech/api/overview.md # - Graphql Documentation: tech/api/graphql-docs.md - Rest API documentation: tech/api/swagger-docs.md + - Backend changelog: tech/architecture/CHANGELOG.md + - How to prepare an exercise?: + - INJECT Process: INJECT_process/intro/overview.md + - 01 Understand: + - Phase overview: INJECT_process/understand/overview.md + - 02 Define: + - Phase overview: INJECT_process/define/overview.md + - 03 Prepare: + - Phase overview: INJECT_process/prepare/overview.md + - 04 Execute: + - Phase overview: INJECT_process/execute/overview.md + - 05 Reflect: + - Phase overview: INJECT_process/reflect/overview.md # - FAQ: faq.md - - Glossary of Terms: glosary-of-terms.md + - Glossary of Terms: glossary-of-terms.md - Authors: authors.md - Report bugs: report-bugs.md - Acknowledgements: acknowledgements.md @@ -37,6 +50,8 @@ nav: markdown_extensions: - attr_list - md_in_html + - admonition + - pymdownx.details - def_list - pymdownx.emoji: emoji_index: !!python/name:material.extensions.emoji.twemoji @@ -50,9 +65,10 @@ markdown_extensions: class: mermaid format: !!python/name:pymdownx.superfences.fence_code_format + extra_css: - stylesheets/extra.css plugins: - render_swagger - - include-markdown \ No newline at end of file + - include-markdown