CYBRARY Forge Playbook Builder
Write a response playbook, compile it, and see where it stops for a person.
What is in it
For soar engineer, automation lead, detection engineer — prove a playbook does what it says before it touches anything.
- Plain-line authoring compiled by the same engine the graded cases run
- A debugger that names unreachable steps, missing gates and what the run would write
- Every pause for a human listed before the first step runs
- Only actions the engine can really execute compile — the rest are errors on purpose
What it is not
- It drives the simulated estate, not your production SOAR platform
- No connector marketplace: integrations are modeled, including their failures
Forge Playbook Builder against the field
19 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: Tines, Torq, Splunk SOAR, Palo Alto XSOAR. Tines, Torq, Splunk SOAR, Palo Alto XSOAR sit outside the eight-vendor research, so they carry no marks below — named for honesty, not scored.
- You build automation against a simulated estate that fails realistically, so people learn recovery, not happy paths.
- Not a production SOAR license — and we say so rather than competing with one.
| What you need | Forge Playbook BuilderIncluded in the platform |
|---|---|
| SOC investigation exercise | Yes See it live |
| Alert triage with true and false positive decisions | Yes See it live Every case ships with innocent lookalikes so closing everything scores badly. |
| SIEM query and investigation practice | Yes See it live |
| Endpoint analysis and access | Yes See it live |
| Threat hunting kept separate from alert triage | Yes See it live |
| Investigation that crosses multiple tools | Yes See it live One estate behind SIEM, EDR, case service, network devices and the wire. |
| Analyst report or evidence submission | Yes See it live |
| Measured investigation and response timing | Yes See it live Dwell time, containment time and SLA clocks are scored, not just recorded. |
| Detection-engineering curriculum | Yes See it live |
| SOAR concepts and workflow training | Yes See it live |
| Learner authors an executable SOAR playbookDeliberately stricter than the row above: a SOAR-looking screen is not a runtime. | Yes See it live Draft, run, fail, repair and rerun against the live estate, with an audit trail. |
| Connector failure and replay debugger for automation | Yes See it live Deterministic integration faults with idempotent retries. Not established for any vendor in the research. |
| Configuration changes alter the exercise | Yes See it live Firewall, routing and policy edits change what the wire and the SIEM then show. |
| Tests a customer's deployed security controls | By design, no Different business, different liability. Partner rather than relabel. |
| Managed continuous validation service | By design, no |
| Customer-specific production adversary scenarios | By design, no |
| Retest remediation against actual defenses | By design, no We teach analysts to read and act on validation evidence; we do not produce it. |
| Rogue access point owned by the estate, not scripted | Yes See it live |
| Each scenario carries its own SIEM, alerts and case databaseNo shared global console: an alert raises a case on the estate it came from, and cannot leak into another team's exercise. | Yes See it live |
The run behind this line: Containment under a running clock
A playbook bench: the intrusion is live, and the deliverable is automation that contains it without breaking the business.
Opponent: Intruder moving fast enough that manual response loses. Shaped after Response timelines from published hands-on-keyboard intrusion reports. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.
How it starts — the message delivered to the mailbox
- From
- Managed Detection Partner <alerts@mdr-partner.example>
- Subject
- P1: confirmed hands-on-keyboard activity on FIN-WS-04
- This one is genuine — the pressure is real and the clock is already running
- It names the host but not the account, so scope is still yours to establish
- It hands the destructive action to you deliberately
Graded verdict: legit — T1078. Nothing here sends or resolves anywhere real.
The steps, and the zone each one crosses
| # | Tactic | ATT&CK | On the range | IEC 62443 zone |
|---|---|---|---|---|
| 1 | Credential access | T1078 Valid accounts | A stolen account is already interactive on a finance workstation. | Identity |
| 2 | Lateral movement | T1021.001 Remote desktop protocol | The session hops to a second host over RDP while you build the playbook. | Enterprise |
| 3 | Exfiltration | T1048 Exfiltration over alternative protocol | Files start leaving over an outbound channel the firewall still allows. | Enterprise |
Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Identity (Purdue level 4, via LDAP and Kerberos to the domain controllers). How the zone model is used.
The alerts the SIEM raises from this run
Interactive logon by a service-class account
Logon type 10 for an account whose role never logs on interactively.
directory audit · stage 1 · LINE-PLAYBOOK-01 · T1078
RDP between two workstations
Workstation-to-workstation 3389, which the build never needs.
network sensor · stage 2 · LINE-PLAYBOOK-02 · T1021.001
Large outbound transfer on an unusual port
Sustained egress on a port with no business history.
network sensor · stage 3 · LINE-PLAYBOOK-03 · T1048
What the case has to hold before it closes
- Every step the playbook takes, and which ones pause for a human
- The isolation action and the business impact it carries
- Proof that each automated step did what it claimed
- The step that would have run against the wrong host, and the gate you added
Start learning this line
Containment under time pressure — the step most playbooks get wrong.
A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.