Accessing the Demo Report
1
Navigate to the demo report
From your dashboard, look for the “Demo Report” button on the sidebar.
2
Explore report sections
Scroll through the report to view all available sections and features. The demo report contains a complete tabletop exercise scenario with all data populated.
You must be signed in to your Ally account to access the demo report. The demo report is available as view-only to all users regardless of their organization or role.
Report Overview
The demo report presents a complete tabletop exercise scenario featuring:- Exercise Scenario: An insider threat scenario at a fictional $2B community bank
- Participants: Multiple participants with assigned roles
- Injects: Multiple scenario injects that escalate throughout the exercise
- Duration: Full exercise timeline with timestamps and annotations
Report Sections
Overview and Outcomes
The left side of the report displays key information about the exercise:- Participants: List of all exercise participants with their roles and IR (Incident Response) roles
- Exercise Overview: Summary of the exercise scenario and objectives
- Objectives: List of exercise objectives that were tested
Participant names can be hidden or shown based on the report’s display settings. In the demo report, participant names are visible.
Key Insights
The Key Insights section highlights the most important findings from the exercise analysis. This section provides a high-level overview of critical observations and outcomes.Action Items
Automatically extracted action items from the exercise transcript are displayed with:- Priority Levels: High priority items (up to 5) and low priority items
- Ranking: Items are ranked by importance and can be reordered by Admin in customer reports.
- Full Content: Each action item includes detailed description and context
Lessons Learned
This section captures three categories of takeaways:- What Went Well: Positive aspects and successful responses during the exercise
- Lessons Learned: Key insights and knowledge gained from the exercise
- Do Better: Areas for improvement and recommended changes
Recommendations
The Recommendations section provides strategic guidance based on the exercise outcomes, offering actionable suggestions for improving incident response capabilities.Performance and Engagement
The main content area features interactive performance analysis:- Inject Selector: Filter the view by specific injects or view all injects together
- Engagement Metrics: Visual representation of participant engagement throughout the exercise
- Performance Trends: Analysis of how the team performed across different scenario phases
When you scroll down the page, the inject selector appears in the header for easy access while viewing other sections.
Preparedness Grades
The Preparedness Grades section evaluates the team’s performance across four IR areas:- Prepare: How well the team was prepared for the scenario
- Detect: Ability to detect and identify the incident
- Respond: Effectiveness of response actions
- Recover: Recovery capabilities and post-incident activities
Sentiment Analysis
Sentiment analysis tracks the emotional tone and stress levels throughout the exercise:- Stress Scores: Numerical stress scores for each inject
- Sentiment Levels: Classification of sentiment (e.g., HIGH, MEDIUM, LOW)
- Reason Summaries: Brief explanations of what contributed to the sentiment
- Detailed Analysis: Full context for sentiment changes
Collaboration Chart
Visual representation of collaboration patterns:- Participant Interactions: How participants communicated and collaborated
- Discussion Types: Categories of discussions (ideas, questions, decisions, etc.)
- Gap Identification: Visual indicators of where gaps in communication or process occurred
Talk Time Analysis
Analysis of speaking time distribution:- Participant Talk Time: How much each participant contributed to discussions
- Per-Inject Breakdown: Talk time analysis for each scenario inject
- Visual Charts: Graphical representation of speaking time distribution
MITRE ATT&CK Chain
Mapping of the exercise scenario to the MITRE ATT&CK framework:- Attack Tactics: Tactics used in the scenario (e.g., Exfiltration, Persistence)
- Techniques: Specific techniques employed
- Asset Mapping: Assets affected by each tactic
- People, Process, Technology: Analysis across these three dimensions
- Threat Group: Attribution and threat intelligence context
Timeline
Chronological view of the exercise:- Scenario Timeline: Exercise events mapped to scenario time
- Decisions: Key decisions made during the exercise
- Reasons: Reasoning behind decisions
- Outcomes: Results and consequences of actions
- Stress Indicators: Stress scores at different timeline points
Transcript View
The demo report includes a full transcript view accessible from the report header by selecting ‘View Transcript’.Transcript Features
- Search Functionality: Search through the transcript text to find specific discussions or topics
- Speaker Identification: Each transcript entry shows the speaker name and timestamp
- Download: Download the full transcript as a text file
- Highlighted Search Results: Search terms are highlighted in yellow when found
1
Access transcript
Click the “Transcript” link in the report header.
2
Search transcript
Use the search box at the top to find specific content within the transcript.
3
Download transcript
Click the “Download Transcript” button to save the transcript as a text file.
Demo Report Limitations
- Edit Report: The edit functionality is not available for the demo report. All report data is static and cannot be changed.
- Export Report: PDF export is disabled for the demo report
- Delete Report: The demo report cannot be deleted
These limitations ensure the demo report remains consistent for all users and serves as a reliable example of Ally’s capabilities.
Using the Demo Report
The demo report is designed to help you:- Understand Report Structure: See how Ally organizes and presents tabletop exercise data
- Explore Features: Interact with all available report sections and visualizations
- Learn Best Practices: Review how the exercise was structured and what data was captured
- Share with Stakeholders: Show colleagues and leadership what to expect from Ally reports
Frequently Asked Questions
Can I use the demo report data for my own exercises?
Can I use the demo report data for my own exercises?
The demo report is a sample scenario and cannot be used as a template for your actual exercises. However, you can use it as a reference for understanding the types of data and insights that Ally provides.
Is the demo report based on a real exercise?
Is the demo report based on a real exercise?
No, the demo report is a fictional scenario created to demonstrate Ally’s capabilities. It does not represent a real organization or actual incident.
Can I compare my reports to the demo report?
Can I compare my reports to the demo report?
While you cannot directly compare your reports to the demo report within the application, you can use the demo report as a reference for understanding report structure and features when reviewing your own exercises.
Will the demo report data change?
Will the demo report data change?
The demo report data is static and will remain consistent to provide a reliable reference point. It may be updated periodically to showcase new features, but the core scenario will remain the same.