This paper explores the potential of a collaborative tabletop game called Operation Raven to improve incident response processes for critical infrastructure. The game material consists of a game board representing the IT network of a critical infrastructure, various cards, and structured response cards to simulate cyber security incident scenarios. The game introduces hypotheses as a collaborative basis for response actions. Operation Raven is based on de facto standards such as the MITRE ATT&CK Framework and the incident response phases outlined by SANS and NIST. Players are exposed to real-world scenarios and challenges, and playing means training in incident response tasks, communication, and decision-making. The game design encourages players to think critically, analyze available information, collaborate, and make informed decisions. The article presents the game design and the results of the game evaluation after three design iterations and ten game events.