CYBRARY Program
SOC operations
The detection and response core: query telemetry, triage a queue, hunt a hypothesis, automate the response and prove the control fired.
Who it is for: SOC analysts, detection engineers, threat hunters and automation engineers.
The path through it
Start on the hunt labs learning to ask a question of telemetry, carry that fluency into SOAR so the playbooks you write trigger on queries you can defend, and finish on the capstones that grade the whole arc.
- 1 · Query fluency
Five short labs, one telemetry family each. You leave able to write the aggregation, the substring match and the identity timeline without a cheat sheet.
- qr-01-hunt-the-wireHunt: the wire25 min
- qr-02-hunt-the-endpointHunt: the endpoint25 min
- qr-03-hunt-the-identityHunt: the identity30 min
- qr-07-hunt-the-credentialsHunt: credential theft30 min
- qr-10-hunt-the-channelHunt: command and control35 min
- 2 · Response automation
SOAR opens once the query underneath the playbook is yours. Runs, credentials, artifact discipline and the same incident in three vendor vocabularies.
- f-101Anatomy of a workflow run25 min
- f-102Credentials, scopes and the vault boundary30 min
- s-101Artifact discipline35 min
- c-201One incident, three vocabularies45 min
- 3 · The chained hunt
An intrusion followed end to end in one dialect chosen on purpose.
- qr-08-hunt-the-spreadHunt: lateral movement60 min
- b-301Bridge: from chained hunt to triggered playbook40 min
- 4 · Capstones
Promote a detection from the hunt, hand it to assurance for validation, then automate the response around it.
- dr-401ContentOps: validate the promoted rule60 min
- k-a01Identity-compromise capstone90 min
- k-b01Capstone B: query to containment, with a debrief90 min
- k-c01SOC analyst capstone: live telemetry to containment75 min
NICE capabilities this program evidences
- Telemetry queryingfirst proven in qr-01-hunt-the-wireWrite and defend searches against host, network, identity and cloud telemetry.
- Threat huntingfirst proven in qr-01-hunt-the-wireFollow an intrusion across telemetry families from a hypothesis, not an alert.
- Response automationfirst proven in f-101Author, version and safely gate a playbook that changes the estate.
- Incident triagefirst proven in f-101Qualify, scope and prioritize an alert into a case with evidence attached.
- Evidence handlingfirst proven in s-101Preserve artifacts and keep an auditable chain from observation to conclusion.
- Detection engineeringfirst proven in b-301Promote a search into a rule with a threshold, an owner and a tested false-positive budget.
- Control assurancefirst proven in dr-401Prove a control collects, matches and notifies — and find the stage where it does not.
Roles this program trains toward
- SOC analyst
The seat that decides, within minutes, whether an alert is noise, a misconfiguration or an intrusion — and leaves evidence behind either way.
Other programs
- Ransomware resilience — Everything after impact: trustworthy recovery points, isolated proof, forest recovery, staged reconnection and an after-action record that survives review.
- Governance & audit — Controls, evidence and the paperwork an auditor will actually accept — assessed the way a real assessment runs, on artifacts rather than assertions.
- AI security — Securing the agents now sitting inside the SOC: prompt injection, poisoned tool catalogs, approval ceilings and the oversight boundary around autonomy.
- Adversary craft & systems — Host-level ground truth: patch state, exploitation preconditions and the machine behavior every detection above it depends on.