Four tickets, one resolver: name resolution, profile drift and a stale gold image Start this lab

Why this matters

Four tickets arrived from four teams and they are one fault. Name resolution sits underneath the failover agent, the certificate, the directory login and the log target, so one dead resolver looks like four unrelated outages — and gets fixed four wrong ways.

Concepts

Objectives graded

• Sort the failing checks by cause before closing any of them.
• Read the refusal the failover agent and the certificate renewal return.
• Compare the resolvers on every host, forwards and in reverse.
• Bring the drifted host back to the profile the cluster shares.
• Patch the golden image before generalising it, and say why that order matters.

MITRE ATT&CK coverage

Name resolution is the quiet dependency underneath every authenticated platform operation, and a golden image is a supply chain of one: whatever is in it — missing patches, a shared machine identity — is inherited by every machine built from it.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A reversible action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The platform was worked in the console rather than described from the ticket.

  investigation · weight 15

• The platform was measured before it was touched.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• Four separate-looking failures were traced back to a single host.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The cause was named as a specific resolver rather than as 'DNS problems'.

  investigation · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The quieter fault - the image every new machine inherits - was found too.

  investigation · weight 10 · T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (Initial Access)

• The image's currency was recorded as a figure the next reviewer can check.

  investigation · weight 5 · T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (Initial Access)

• Name resolution, profile drift and the golden image were all put right and the result measured.

  configuration · weight 15 · T1078 Valid Accounts (Defense Evasion)

Common mistakes

• Raising four tickets as four faults and fixing four symptoms.
• Testing name resolution in one direction only.
• Trying to remediate a host profile without moving the guests off first.
• Generalising a stale image, so every clone starts by installing a year of updates.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.