Part two [https://blog.jonsdocs.org.uk/2021/04/18/wargaming-running-incident-response-plan-tests-pt2/] finished with our defenders heading in the right direction to find the simulated infection.  They'll have used a combination of tools in order to get this far, likely including firewall and network logs.  As a reminder, for

The time has come to run your wargame, let's look at what happens on the day itself.

Cyber exercising is important for checking how a team responds to an incident.