The analyst capstone runs on the estate's live telemetry rather than a fixture. Hunt with searches that execute against the real index, build the case on those results, contain the endpoint and the identity under approval, and file the debrief the cohort report reads.
Mission brief · K-C01
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
EDR console (detections + live response)
Endpoint detection & response
Live-response shell on the affected host
Host shell session
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
You may act alone
Ask a human first
You are running the incident, not just the console: expect to decide who gets woken, what leadership is told, and when to hand technical work to the bench.
A playbook that acts on values somebody typed into a ticket is a demo. This capstone runs the chained hunt's searches against the estate's live index and grades the case on what those searches actually returned, so the containment you approve is containment of something the telemetry proves.
Each investigative rule here asserts that a specific search filed a specific result on the case. If the feed goes quiet, the evidence is absent and the rule fails — the grade tracks the data, which is the only way a coverage claim can ever be falsified.
Alert context — host, source address, matched volumes, a derived risk score — is bound at case open from the records themselves, so decision nodes branch on measured values rather than defaults.
Isolating the workstation stops the beacon; disabling the attributed account stops the way back in. Both are consequential, both pass a gate, and both end states are graded.
Every hunt stage that matched nothing is a coverage gap with an owner. Writing it down is what turns a passing run into an assurance record the cohort report can reduce.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
CYBRARY srcIp=203.0.113.77 outcome=failure | stats count by user | sort -countuser=svc_deploy process=certutil.exe | table time, host, process, commandLineprocess=certutil.exe | stats sum(bytesOut) as bytes by destIp | sort -bytesdestIp=198.51.100.24 destPort=53 | table time, host, destHostdestIp=198.51.100.24 outcome=failure | table time, host, destPort, processA stage that matches nothing files no evidence, and the rubric rule that reads it fails — the grade tracks the feed.
Gate approved — 100%
15 of 15 rubric rules hold.
Gate denied — 83%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
Password spraying lands on a service account, a downloader pulls the implant, DNS carries the command channel and data leaves over an alternative protocol — every step read off the live index before anything is contained.
| Technique | Name | Tactic |
|---|---|---|
| T1110.003 | Password Spraying | Credential Access |
| T1105 | Ingress Tool Transfer | Command and Control |
| T1071.004 | DNS | Command and Control |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration |
| T1078 | Valid Accounts | Defense Evasion |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The graded run was started by the learner's own promoted detection.
configuration · weight 10 · T1110.003 Password Spraying (Credential Access)
The authentication hunt ran against live telemetry and its matches are on the case.
investigation · weight 15 · T1110.003 Password Spraying (Credential Access)
The command-and-control hunt ran against live telemetry and its matches are on the case.
investigation · weight 15 · T1071.004 DNS (Command and Control)
The beaconing workstation is isolated at end state.
behavior · weight 20 · T1105 Ingress Tool Transfer (Command and Control)
The account the hunt attributed the intrusion to is disabled pending review.
behavior · weight 15 · T1078 Valid Accounts (Defense Evasion)
A written debrief was filed: what the telemetry proved, what is automated, what is still uncovered.
explanation · weight 20 · T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol (Exfiltration)
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
| workflow-run | Playbook run | Playbook debug run | Story run |
| approval | Manual task | Prompt | Page |
| note | War Room entry | Note | Case note |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
| workflow-run | Playbook run | Playbook run / debug run | Event flow | Logic App run | Playbook execution | Playbook execution | Execution | Workflow execution | Flow execution |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
Grades what a shift handover grades: the searches that justified the action are on the case with their result counts, host and identity are both contained under a recorded approval, and the debrief states the telemetry gap that remains.
Cortex XSOARPalo Alto Networks
A search command in the playbook writes its results to war-room context; that context is the evidence the review reads.
Splunk SOARSplunk (Cisco)
A run-query block stores results as artifacts on the container, so downstream containment blocks act on rows, not on typed values.
TinesTines
An HTTP request to the search API feeds the story; the recorded event body is the case evidence.
ServiceNow Security OperationsServiceNow
Sighting search results attach to the security incident and drive the containment tasks that follow.
IBM QRadar SOARIBM
An AQL search function populates incident artifacts before the containment phase can be closed.
Hunt on live telemetry, attach the result, contain under approval, state the gap — the loop every SOC runs on every real incident, in any stack.