CYBRARY Start here — pick your seat
Tier 1 analyst
Queue work: reported phish, alert triage, escalate what you cannot close.
Tier 2 responder
Detection-led investigation: start at the EDR alert, identify the host, decide containment.
Detection / automation engineer
Build and prove the playbook other people will run at 3am.
IR lead / SOC manager
Run the incident: sequencing, approvals, and the calls to identity, HR and legal.
SOAR pilot curriculum
Twelve missions across foundations, the three teaching profiles, cross-platform craft, AI safety and a capstone. Every rubric grades end state and evidence — a different but valid Playbook scores the same.
Your seat:
F-101 — Anatomy of a workflow run
A phishing-triage workflow has already run and left its mark on the case. Read the run end to end, from node attempts and resolved bindings to branch operands, and say exactly what it changed.
Read the theory for F-101Objectives
- Identify the node whose resolved binding differed from the authored expression
- Explain the branch decision using its operands
- Attribute the run to an immutable version id
Scenario seed · low noise
seed soar-soar-f-101
- mailbox mbx-l.ferrara
- user usr-l.ferrara
- indicator ind-sso-portal
- alert alt-phish-8821
Why this score — 100/100 (pass)
- configuration100%
- behavior100%
- investigation100%
- safety100%
- efficiency100%
- explanation100%