Who would be the ideal facilitator for a recurring annual Cybersecurity Incident Response TTX?
We conducted an exercise last year with the Cybersecurity Manager serving as the facilitator, but that prevented him from fully participating in the exercise as the Incident Response Manager. Would it be better to have someone else facilitate so that active participants are not excluded from the exercise?
Who typically facilitates the TTX at your organization?

EDIT: We cannot engage consulting firms to facilitate the TTX. I’m looking for suggestions internally on who would be the ideal facilitator for the exercise.

Is it possible to configure IP reputation score-based policy on Palo Alto firewall that blocks traffic to and from public IP addresses with low reputation score?