Mission brief · A-230

Detection & automation engineer

Detection / automation engineer

Business important

Track default

You are acting as

you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)

How you got here

You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.

Your access

Automation platform (author + test)
Automation platform
- Edit playbooks
- Run against a replayed case
- Inspect run history and context paths
- Not yours: Act on production hosts
- Not yours: Approve your own consequential actions
Ticketing (read + work notes)
Ticketing / ITSM
- Read the originating case
- Attach run evidence to the case

What's at stake

The playbook itself

Owner: SOC manager (approves anything that touches production)

A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.

Rules of engagement

You may act alone

Edit and test the playbook
Run it against the replayed case
Write work notes

Ask a human first

Promoting the playbook to production
Any action node that contains, disables or deletes

Where this sits in a real SOC

In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.

How much help do you want?

Objectives stay open and every step explains why it matters before it tells you what to run. Hints are free.

Graded case walkthrough

Open a lab as a live case and advance it one node at a time. The score beside each step is the lab rubric re-evaluated against what the engine actually did.

Lab

The assistant triages the queue on its own overnight. Review what it did, catch the one action it should have stopped for, and rebuild the oversight boundary so the same shift is safe to repeat.

Range guide

Guided

Every step explains why it matters before it tells you what to do. Reasoning is free in guided mode.

Prove it

1. The learner attached at least one linkable piece of evidence to the case.
Why this step: The learner attached at least one linkable piece of evidence to the case. It carries 10 points on the investigation dimension.
2. Nothing was changed in the estate before evidence had been gathered.
Why this step: Nothing was changed in the estate before evidence had been gathered. It carries 10 points on the investigation dimension.
3. The shift was reconstructed on the runner itself.
Why this step: The shift was reconstructed on the runner itself. It carries 15 points on the investigation dimension.
4. The action that undid containment was named from the audit trail.
Why this step: The action that undid containment was named from the audit trail. It carries 10 points on the investigation dimension.
5. The host whose containment was lifted was identified.
Why this step: The host whose containment was lifted was identified. It carries 10 points on the investigation dimension.
6. The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.
Why this step: The analyst scoped the host's network from the wire, so containment decisions know which segment is in play. It carries 5 points on the investigation dimension.
7. The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
Why this step: The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess. It carries 3 points on the investigation dimension.
8. Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
Why this step: Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible. It carries 3 points on the investigation dimension.

Decide and act

1. The workflow reached a terminal success state on the graded run.
Why this step: The workflow reached a terminal success state on the graded run. It carries 20 points on the behavior dimension.
2. A consequential action passed through a human approval gate.
Why this step: A consequential action passed through a human approval gate. It carries 15 points on the safety dimension.
3. No non-idempotent operation was retried without an idempotency key.
Why this step: No non-idempotent operation was retried without an idempotency key. It carries 10 points on the efficiency dimension.
4. Every action node resolves its secret from the vault, never an inline field.
Why this step: Every action node resolves its secret from the vault, never an inline field. It carries 10 points on the configuration dimension.
5. No innocent asset in the alert batch was contained, disabled or revoked.
Why this step: No innocent asset in the alert batch was contained, disabled or revoked. It carries 15 points on the behavior dimension.
6. The playbook survived the integration faults it met and still finished.
Why this step: The playbook survived the integration faults it met and still finished. It carries 15 points on the configuration dimension.
7. The action the agent took past its ceiling was identified and evidenced.
Why this step: The action the agent took past its ceiling was identified and evidenced. It carries 25 points on the safety dimension.
8. The destination of the overnight export was evidenced from the gateway log.
Why this step: The destination of the overnight export was evidenced from the gateway log. It carries 10 points on the configuration dimension.
9. The host the agent mis-triaged as benign is isolated after human review.
Why this step: The host the agent mis-triaged as benign is isolated after human review. It carries 20 points on the behavior dimension.

Write it up

1. The case carries an analyst closure note explaining the outcome.
Why this step: The case carries an analyst closure note explaining the outcome. It carries 10 points on the explanation dimension.
2. The debrief traces the agent's justification back to an unsigned catalog refresh.
Why this step: The debrief traces the agent's justification back to an unsigned catalog refresh. It carries 10 points on the explanation dimension.
3. A debrief states which decisions the agent may keep and which return to a human.
Why this step: A debrief states which decisions the agent may keep and which return to a human. It carries 20 points on the explanation dimension.

Your cases

No cases opened yet.