CYBRARY Program catalog
SOC operations labs
Start on the hunt labs learning to ask a question of telemetry, carry that fluency into SOAR so the playbooks you write trigger on queries you can defend, and finish on the capstones that grade the whole arc.
15 labs across 4 stages. Prerequisites are advice, not a lock — you can open any lab, but the ones listed underneath it are what it assumes.
1 · Query fluency
Five short labs, one telemetry family each. You leave able to write the aggregation, the substring match and the identity timeline without a cheat sheet.
- qr-01-hunt-the-wireHunt: the wire25 min
Telemetry querying · Threat hunting
- qr-02-hunt-the-endpointHunt: the endpoint25 min
Telemetry querying · Threat hunting
- qr-03-hunt-the-identityHunt: the identity30 min
Telemetry querying · Threat hunting
- qr-07-hunt-the-credentialsHunt: credential theft30 min
Telemetry querying · Threat hunting
- qr-10-hunt-the-channelHunt: command and control35 min
Telemetry querying · Threat hunting
2 · Response automation
SOAR opens once the query underneath the playbook is yours. Runs, credentials, artifact discipline and the same incident in three vendor vocabularies.
- f-101Anatomy of a workflow run25 min
Response automation · Incident triage
Assumes first:
- qr-01-hunt-the-wire — A workflow run is only legible once you can read the telemetry it triggers on.
- f-102Credentials, scopes and the vault boundary30 min
Response automation
- s-101Artifact discipline35 min
Evidence handling · Incident triage
- c-201One incident, three vocabularies45 min
Response automation · Incident triage
3 · The chained hunt
An intrusion followed end to end in one dialect chosen on purpose.
- qr-08-hunt-the-spreadHunt: lateral movement60 min
Telemetry querying · Threat hunting
- b-301Bridge: from chained hunt to triggered playbook40 min
Telemetry querying · Detection engineering · Response automation
Assumes first:
- qr-08-hunt-the-spread — The bridge turns a chained hunt into a trigger, so follow the intrusion first.
4 · Capstones
Promote a detection from the hunt, hand it to assurance for validation, then automate the response around it.
- dr-401ContentOps: validate the promoted rule60 min
Control assurance · Detection engineering
Assumes first:
- ag-lineage-gap — Validating promoted content means tracing every claim to the tool that made it, which is the lineage drill.
- k-a01Identity-compromise capstone90 min
Incident triage · Response automation · Evidence handling
- k-b01Capstone B: query to containment, with a debrief90 min
Threat hunting · Response automation · Evidence handling · Control assurance
Assumes first:
- b-301 — Capstone B is the bridge pattern under blind conditions and real consequence.
- k-a01 — Capstone B assumes you have already contained an identity compromise once.
- dr-401 — Capstone B's debrief is graded like an assurance record, not like a chat message.
- k-c01SOC analyst capstone: live telemetry to containment75 min
Telemetry querying · Threat hunting · Incident triage · Response automation · Evidence handling
Assumes first:
- k-b01 — The SOC analyst capstone repeats the arc on live telemetry, so the scripted version comes first.