CYBRARY AI SOC
An agent on shift with you, reading the detections this estate actually raised. It runs the read-only work and asks before anything changes. It is wrong sometimes — that is the exercise.
Pick an estate. Each lab and scenario runs its own world with its own SIEM, so the agent has nothing to read until you say which shift you are on.