The yard's handhelds keep dropping and a bigger access point will not fix it. Measure the cell in the wireless console: channel, noise floor, non-Wi-Fi energy on that channel, the cells sharing it, and the station at the bottom of the rate table eating the airtime. Then name the channel to move to.
Mission brief · N-410
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
EDR console (detections + live response)
Endpoint detection & response
Live-response shell on the affected host
Host shell session
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
You may act alone
Ask a human first
A radio cell is a single shared conversation, and everything in earshot takes part in it — your clients, the neighbors' network, and anything else transmitting in the band whether it speaks Wi-Fi or not. Congestion is therefore measured in time, not in megabits, and the fixes that work are the ones that give time back.
Only one station in a cell transmits at a time. A device at 6 Mbps takes twenty-four times as long to send the same frame as one at 144 Mbps, so the weakest client can spend most of the cell on its own while barely moving any data. That is why a single distant handheld slows everyone.
Signal strength alone means nothing; the gap between it and the noise floor — the signal-to-noise ratio — decides the rate the link negotiates. Lift the floor five decibels and every station in the cell drops down the rate table without a single thing about them changing.
Microwave ovens, analogue camera links and cordless gear transmit in the same 2.4 GHz band and cannot hear Wi-Fi, so they never wait their turn. A spectrum view shows them; a Wi-Fi scan never will, which is why 'no other networks here' is not the same as 'the channel is clear'.
A neighbor on your exact channel is heard and politely taken turns with, halving throughput. A neighbor part-way between channels is not decodable, so it corrupts frames instead. In 2.4 GHz only 1, 6 and 11 avoid the second case entirely.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
18 of 18 rubric rules hold.
Gate denied — 93%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
Reading a cell — its channel, its neighbors and every station associated to it — is exactly the survey an attacker parked outside the fence performs. Doing it deliberately, from inside, is how you learn what your own air gives away.
| Technique | Name | Tactic |
|---|---|---|
| T1016 | System Network Configuration Discovery | Discovery |
| T1046 | Network Service Discovery | Discovery |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A reversible action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The cell was measured from the yard seat rather than described from the ticket.
investigation · weight 15
The cell's channel was read off the access point rather than assumed.
investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
The measured noise floor was recorded, not the band's quiet-time figure.
investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
The non-Wi-Fi source lifting the floor was identified.
investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
Congestion was measured as airtime rather than guessed from throughput.
investigation · weight 10 · T1046 Network Service Discovery (Discovery)
Co-channel neighbors were counted and kept separate from overlapping ones.
investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
The station spending the cell's airtime was named.
configuration · weight 10 · T1046 Network Service Discovery (Discovery)
A concrete, non-overlapping channel was proposed on the evidence gathered.
configuration · weight 10
Nothing was disabled or reconfigured in the estate over a radio complaint.
safety · weight 10
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
Any shared medium answers the same questions: how much of the capacity is already spent, who is spending it, and how much of the spend is retries rather than work.
CYBRARY