CYBRARY One incident, three nouns
Incident, container, story-scoped record: same object, same responsibilities, different label. Translate deliberately and the second platform takes days rather than months.
C-201·Cross-platform·45 min
One incident, three vocabularies Start this lab
The same identity-compromise incident has to be worked in three vendors' vocabularies. Move it through all three profiles and map every concept across them, from incident to container to case, without changing the engine underneath.
Mission brief · C-201
Tier 3 analyst on the incident response bench
Tier 3 — deep host and forensics
Business important
Track default
You are acting as
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
How you got here
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
Your access
EDR console (detections + live response)
Endpoint detection & response
- Read the detection and process tree
- Look up host criticality, owner and VIP flags
- Open a live-response session on the host
- Contain the host over the agent channel
- Not yours: Disable user accounts (that's the identity team)
- Not yours: Delete evidence
Live-response shell on the affected host
Host shell session
- Read the filesystem, logs and running state
- Collect a triage package
- Not yours: Reboot or reimage without owner approval
What's at stake
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
Rules of engagement
You may act alone
- Investigate from the live-response session
- Collect evidence and triage packages
- Contain a standard-criticality host
Ask a human first
- Containing a mission-critical host — asset owner and on-call manager first
- Disabling a user identity — identity team, and HR/legal if it looks like an insider
Why this matters
Analysts change tools every few years. If your knowledge is a set of screen positions, it evaporates; if it is a set of concepts with three names each, it moves with you.
Concepts
Task, block, action
The unit of work has a different name and near-identical semantics everywhere: inputs bound at run time, a typed result, a risk classification.
Three path syntaxes, one idea
`${...}`, dotted datapaths and `<<...>>` all answer the same question — where did this value come from. The syntax is trivia; the provenance is the skill.
Objectives graded
- Translate all canonical terms across profiles
- Show identical end state from three surfaces
- Explain which differences are cosmetic
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve reversible actionpromptapproval gateApprove reversible action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-c-201/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.Write case field vocabularyMappedactionvocabularyMapped → complete
- 6.Attach evidence: case/parity-reportactionThe learner showed the three profiles produced equivalent end state.
Gate approved — 100%
11 of 11 rubric rules hold.
Gate denied — 91%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A reversible action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass configuration · Every canonical term was mapped to all three vendor vocabularies.
- pass investigation · The learner showed the three profiles produced equivalent end state.
MITRE ATT&CK coverage
One identity-compromise intrusion, three consoles: same techniques, three sets of nouns.
| Technique | Name | Tactic |
|---|---|---|
| T1078 | Valid Accounts | Defense Evasion |
| T1114.003 | Email Collection: Email Forwarding Rule | Collection |
| T1021.001 | Remote Desktop Protocol | Lateral Movement |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A reversible action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
Every canonical term was mapped to all three vendor vocabularies.
configuration · weight 25 · T1078 Valid Accounts (Defense Evasion)
The learner showed the three profiles produced equivalent end state.
investigation · weight 20 · T1114.003 Email Collection: Email Forwarding Rule (Collection)
Common mistakes
- Learning menus instead of concepts.
- Assuming a vendor word means something unique when it is a rename.
- Missing the genuine differences — change control and path semantics really do vary.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| case | Incident | Container | Case |
| node | Task | Block | Action |
| context-path | Context path | Datapath | Event path |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| case | Incident | Container | Case | Incident | Case | Record | Case | Incident | Security incident (SIR) |
| node | Task | Block | Action | Action / step | Action / step | Action | Step | Function / script | Flow action |
| context-path | Context path (${...}) | Datapath | Formula (<<path.to.value>>) | Expression (@{body('step')}) | Placeholder ([Entity.Identifier]) | Reference ($record.field) | Expression ({{ .event.field }}) | Rule/script object (incident.properties) | Data pill |
How this rubric maps to production SOC work
Scores whether the response's end state — accounts, hosts, tickets, evidence — is correct independent of which product produced it.
Cortex XSOARPalo Alto Networks
Same end state, expressed as incident fields and closed Work Plan tasks.
Splunk SOARSplunk (Cisco)
Same end state, expressed as container status, artifacts and workbook phases.
TinesTines
Same end state, expressed as case fields and closed case tasks.
Google SecOps SOARGoogle Cloud
Same end state on the case wall, with entity enrichment attached.
What transfers
This lab is the transfer skill itself: build the mapping table once, and every future migration is a lookup.