A supplier quote in the intake queue reads like a model wrote it, and it carries new remittance details. Score it against the genuine quote from the same supplier, read its provenance manifest and the mail headers, and decide what is actually proven before anyone pays.
Mission brief · A-270
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Automation platform (author + test)
Automation platform
Ticketing (read + work notes)
Ticketing / ITSM
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
You may act alone
Ask a human first
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
A document being machine-written is not a finding on its own — half the business writes with a model now. The finding is machine authorship plus something that only matters if someone is pretending: a provenance manifest that cannot be verified, a sending domain registered last week, and a change to where the money goes. Learning to hold those three facts apart is what stops both the missed invoice fraud and the accusation against an honest supplier who used a drafting tool.
Perplexity and burstiness measure how predictable the text is. They give you a likelihood with a threshold, and like any detector they have a false positive rate — a careful non-native writer scores machine-like, a lightly edited model draft scores human. Quote the score and the threshold, never the impression.
A content credential records what tool made the file and whether the record is signed. An unsigned manifest naming an unapproved generator is a fact about the document's history; 'it reads like a robot' is a fact about your taste.
Domain age, authentication results and a changed remittance line are what turn an authorship question into a payment-fraud case. They are also what a bank will ask for, so gather them in the same pass.
The lookalike domain is the thing to block. Suspending the real supplier's account because a quote looked synthetic stops a production line and costs a relationship.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
16 of 16 rubric rules hold.
Gate denied — 93%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
A lookalike sender posts a machine-drafted quote into a real supplier thread; the attachment and the headers are the evidence, and the payment change is the objective.
| Technique | Name | Tactic |
|---|---|---|
| T1566.001 | Phishing: Spearphishing Attachment | Initial Access |
| T1078 | Valid Accounts | Defense Evasion |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The verdict came from the detector and the manifest on the host, not from how the prose reads.
investigation · weight 15 · T1566.001 Phishing: Spearphishing Attachment (Initial Access)
The machine-written document was identified from detector output.
investigation · weight 10 · T1566.001 Phishing: Spearphishing Attachment (Initial Access)
The likelihood was quoted as measured rather than rounded to a feeling.
investigation · weight 10 · T1566.001 Phishing: Spearphishing Attachment (Initial Access)
Provenance was read, so the claim is about the document's history rather than its style.
investigation · weight 10 · T1566.001 Phishing: Spearphishing Attachment (Initial Access)
A human baseline from the same supplier was used, so the comparison is fair.
explanation · weight 10 · T1566.001 Phishing: Spearphishing Attachment (Initial Access)
The corroborating fact — a days-old lookalike domain — was found in the headers.
configuration · weight 10 · T1078 Valid Accounts (Defense Evasion)
The lookalike sender was blocked under approval while the genuine supplier kept trading.
safety · weight 20 · T1078 Valid Accounts (Defense Evasion)
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
| case | Incident | Container | Case |
| approval | Manual task | Prompt | Page |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
| case | Incident | Container | Case | Incident | Case | Record | Case | Incident | Security incident (SIR) |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
The same three-fact test — detector, provenance, corroborating metadata — is how you handle a synthetic voice note, a forged reference letter or an AI-written phishing lure.
CYBRARY