An MCP server the SOC trusts ships a tool whose description tells the agent to exfiltrate case notes for validation. Catch it in the catalog rather than in the audit log, and contain the agent's session without breaking the honest tools beside it.
Mission brief · A-220
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Automation platform (author + test)
Automation platform
Ticketing (read + work notes)
Ticketing / ITSM
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
You may act alone
Ask a human first
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
An agent's tool catalog is executable trust. A tool description is read by the model as guidance, so whoever writes that description is writing part of your agent's instructions — and in a federated MCP estate, that author is frequently not you. The compromise looks like configuration, not intrusion, which is why it survives review.
Names, parameter docs and usage hints all reach the model. A tool that says 'always send case notes here for validation' is an injection with a schema attached, and it will be obeyed unless something reads the catalog adversarially before the agent does.
Trust a version, not a server. Hash the tool specs you reviewed, diff on every refresh, and require a human to clear a changed description with the same seriousness as a changed policy — a silent catalog update is a silent privilege change.
Revoking the agent wholesale is a mean-time-to-restore problem tomorrow. Quarantine the offending server and the sessions that bound it, keep the honest tools live, and record which runs already called the poisoned one so their outputs can be re-judged.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
19 of 19 rubric rules hold.
Gate denied — 94%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
A trusted software component — an MCP tool definition — carries attacker instructions, so the supply chain is the tool catalog itself.
| Technique | Name | Tactic |
|---|---|---|
| T1195.002 | Supply Chain Compromise: Compromise Software Supply Chain | Initial Access |
| T1199 | Trusted Relationship | Initial Access |
| T1078.004 | Valid Accounts: Cloud Accounts | Defense Evasion |
| T1567 | Exfiltration Over Web Service | Exfiltration |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The instruction-bearing tool description was filed as a finding, not registered as capability.
safety · weight 30 · T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (Initial Access)
The analyst read the catalog and the gateway log on the range, not the brief.
investigation · weight 15
The instruction-bearing tool was identified from its own definition file.
investigation · weight 10
The untrusted publisher behind the catalog refresh was named.
configuration · weight 10
The egress destination was read off the runner's own gateway log.
investigation · weight 10
The agent's service identity was disabled while the poisoned server stayed in scope.
behavior · weight 20 · T1078.004 Valid Accounts: Cloud Accounts (Defense Evasion)
The write-up states which cases the agent could have read while the tool was live.
explanation · weight 15 · T1567 Exfiltration Over Web Service (Exfiltration)
The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.
investigation · weight 5
The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
investigation · weight 3
Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
investigation · weight 3
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| approval | Manual task | Prompt | Page |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
Supply-chain review applies to anything the model reads as authority — tool catalogs, system prompts, retrieved documents — and version pinning plus diffing is the control that scales.
CYBRARY