MetisLoops · OODA loop training
OODA loop training for incident responders
Short decision drills that train each person's Observe, Orient, Decide and Act steps against an attacker on a clock. Each step is scored on its own, so the debrief names the step that broke the loop.
MetisForge Training · MetisLoops
Train each person's decision loop between exercises.
Exercises train the team a few times a year. MetisLoops drills train each person in between: a short incident, played alone, one step at a time, against an attacker on a clock. Included with MetisForge Training on the Professional and Enterprise plans.
What is an OODA loop?
Observe, Orient, Decide, Act. John Boyd, a United States Air Force fighter pilot and strategist, described the cycle every responder runs. The side that turns it faster, on the more accurate picture, keeps the other side reacting to a situation that has already changed.
The loop never stops: every action changes the situation and starts the next turn. Boyd put Orient at the heart of it, because it decides what you notice and which options you see. Training changes how you orient.
01Observe
Take in what is happening.Alerts, logs and telemetry · Reports from users and the service desk · Threat intelligence and advisories02Orient
Make sense of it.Triage and correlation · Competing hypotheses about what is going on · Mapping activity to ATT&CK tactics03Decide
Choose a move.Containment choices: detect, deny, disrupt, degrade or deceive · Which indicator to act on, from a file hash up to the attacker's behavior · Hold and watch, or act now04Act
Carry it out.Isolate, block, reset, rebuild · Notify, escalate, hand over · Verify the effect and keep the evidence
Two loops, one race
In security there is always another loop turning: the attacker's. Tony Sager of the Center for Internet Security calls it dueling OODAs. Every step the attacker takes leaves something to observe, and every move you make changes what the attacker sees next.
Every step scored on its own
Observe, Orient, Decide and Act each get a score, so the debrief names the step that broke your loop instead of giving one number.
An attacker who moves while you think
The incident clock runs while you work. The longer you take, the further the attacker gets.
Acting from training
From the second loop you can run a playbook and skip Decide. It is fast when your reading is right, and costly when it is not.
Drills for your own environment
Your team writes drills about its own systems. Two reviewers approve each one before anyone plays it.
About four minutes: one fictional incident, one loop, and the debrief a learner sees.
New to the loop? 6 Foundations lessons, about 26 minutes in all, each end in a practice drill. A preview or a second try is practice and never goes on anyone's record. More on OODA loop training
How a drill works
One incident, four steps, one clock.
A drill plays the loop in order. This is what you do at each step.
- 01Observe
A feed of alerts, logs, emails and chat. You mark what matters, and noise you mark counts against you.
- 02Orient
Rank the possible readings, name the attacker's tactic, and say how sure you are.
- 03Decide
Choose one move. From loop 2, a playbook lets you skip this step, and it pays off only when your reading was right.
- 04Act
Put the steps in order, or pick the ones that belong. Get it wrong and a good decision still fails.
Foundations
Learn the loop before you race it.
6 short lessons, each ending in a practice drill. Practice never goes on anyone's record.
- 01 · 4 minThe loop
Why responders work in loops, and how a MetisLoops drill runs one.
- 02 · 4 minObserve: see what matters
Picking the signals out of a busy feed, and knowing when to look for more.
- 03 · 5 minOrient: make sense of it
Weighing explanations against the evidence, naming the tactic, and being honest about doubt.
- 04 · 5 minDecide: choose your move
Picking a move that fits your picture, and knowing what it does to the attacker.
- 05 · 4 minAct: carry it out
Doing the right steps in the right order, and nothing that makes things worse.
- 06 · 4 minPutting it together: tempo
Two loops in a row, the cost of time, and when a playbook is the right call.
Questions
Questions about OODA loop training.
What is the OODA loop?
Observe, Orient, Decide, Act: the decision cycle described by John Boyd, a United States Air Force fighter pilot and strategist. Every responder runs it during an incident. The side that turns it faster, on the more accurate picture, keeps the other side reacting to a situation that has already changed.
How does OODA apply to incident response?
Observe is the alerts, logs and reports you take in. Orient is deciding what they mean and which attacker tactic you are facing. Decide is choosing containment or investigation. Act is carrying it out correctly. The attacker runs a loop of their own at the same time, so speed and accuracy at each step both matter.
How long is a MetisLoops drill?
Most drills take five to ten minutes. One person plays one fictional incident, one step at a time, while an incident clock runs and the attacker advances.
How is a drill scored?
Observe, Orient, Decide and Act each get their own score, so the debrief names the step that broke the loop instead of giving one number. Taking longer lets the attacker get further, and that shows in the result.
What are the Foundations lessons?
Six short lessons that teach the loop itself, one step at a time, each ending in a practice drill. Practice and second tries never go on anyone's record.
Can we write drills about our own environment?
Yes. Your team writes drills about its own systems, and two reviewers approve each one before anyone plays it.
Which plans include MetisLoops?
MetisLoops is part of MetisForge Training, included on the Professional and Enterprise plans.
Bring MetisForge to your team
Start with a pilot.
A pilot can start with your industry, threat, exercise objectives, and team structure so you can assess the workflow against a scenario that matters to your organization.