Cybrary ForgeCYBRARY / FORGE
Back to SOAR Range

SOAR dashboard

The shift board. Every incident here is a graded case with a real simulated estate behind it — open one and the topology, findings and rubric are waiting.

3

Active incidents

1

Contained

2

Queued

6

Hands-on cases open

43

Graded cases available

Incidents

  • H-301
    critical
    contained
    opened +17m · Recover · 75 min

    Northwind portal breach: detect, contain, debrief

    The customer portal was compromised through an upload bypass at 01:12, the portal service account reached the finance database, and 1.4GB left the building. Work the box, prove the breach, contain what the evidence implicates, then write the post-incident record.

    Playbook: Breach crossing a segment boundary · 9 findings · 22 graded rules

    Work the case Library entry Playbook
  • H-302
    high
    active
    opened +43m · Triage & scope · 75 min

    Northwind order portal breach: the Windows side

    An IIS application server took an unrestricted upload at 02:47, the app-pool identity reached the order file server over SMB, and a 3.1GB archive is leaving right now. Work the box with cmd.exe, prove all three phases, then contain what the evidence implicates.

    Playbook: Breach crossing a segment boundary · 9 findings · 22 graded rules

    Work the case Library entry Playbook
  • N-401
    medium
    queued
    opened +1h 09m · Detect · 55 min

    Prove the Northwind network is actually segmented

    Audit finding NW-AUD-114 says nobody can demonstrate the corporate VLAN is separated from the server farm, the DMZ and the internet. You get a seat on an ordinary endpoint and nothing else, so prove the design from the wire, including the endpoint holding a session it should not have.

    Playbook: Segmentation assurance · 8 findings · 20 graded rules

    Work the case Library entry Playbook
  • N-402
    high
    active
    opened +1h 35m · Triage & scope · 45 min

    Find the rogue device wired into the corporate VLAN

    An access switch learned a hardware address that appears in no inventory. From a seat on the same VLAN, sweep the subnet, fingerprint the service the device publishes, and prove which rule keeps it away from the file shares. Then find the corporate endpoint already routing through it.

    Playbook: Rogue device on a corporate VLAN · 8 findings · 20 graded rules

    Work the case Library entry Playbook
  • N-403
    medium
    queued
    opened +2h 01m · Detect · 50 min

    Rebuild the Northwind rule base from the wire

    Three firewall migrations later, nobody can say which rules exist, and change control will not approve the next one without evidence. You get an ordinary corporate seat, no console and no exported config. Probe each zone crossing until the rule base identifies itself by number.

    Playbook: Segmentation assurance · 8 findings · 19 graded rules

    Work the case Library entry Playbook
  • N-404
    critical
    active
    opened +2h 27m · Contain · 60 min

    Follow a breach across the subnets it crossed

    Overnight the perimeter logged unusual SMTP from the published web host into the server farm, then outbound TLS from an application server. You get a shell on that server, so work out which DMZ host reached it, which rule carried the data out, and which file server was touched.

    Playbook: Breach crossing a segment boundary · 8 findings · 20 graded rules

    Work the case Library entry Playbook

Shift timeline

  1. +17mH-301 Detect — Take the socket table before anything else
  2. +26mH-301 Triage & scope — Separate inbound pivot from outbound C2
  3. +35mH-301 Contain — Cut egress at the rule, isolate the host
  4. +43mH-302 Detect — Take the socket table before anything else
  5. +44mH-301 Eradicate — Remove persistence on both sides of the pivot
  6. +52mH-302 Triage & scope — Separate inbound pivot from outbound C2
  7. +53mH-301 Recover — Restore the permitted path only
  8. +1h 09mN-401 Detect — Establish where you actually are
  9. +1h 35mN-402 Detect — Sweep the VLAN and diff against the asset list
  10. +1h 44mN-402 Triage & scope — Fingerprint the candidate
  11. +2h 01mN-403 Detect — Establish where you actually are
  12. +2h 27mN-404 Detect — Take the socket table before anything else
  13. +2h 36mN-404 Triage & scope — Separate inbound pivot from outbound C2
  14. +2h 45mN-404 Contain — Cut egress at the rule, isolate the host