CYBRARY Follow the copies, not the record
The request lists the systems it cleared. The interesting question is which systems it never looked at. Training sets, feature stores and evaluation snapshots are copies with their own lifecycles.
A-310·AI safety·35 min
The erasure that never reached the model Start this lab
A deletion request was completed in the business systems in January. The training set still carries the subject, and the model in serving was trained from that set. Count what remains, check the lineage dates, and say plainly whether deleting the rows is enough.
Mission brief · A-310
Detection & automation engineer
Detection / automation engineer
Business important
Track default
You are acting as
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
How you got here
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Your access
Automation platform (author + test)
Automation platform
- Edit playbooks
- Run against a replayed case
- Inspect run history and context paths
- Not yours: Act on production hosts
- Not yours: Approve your own consequential actions
Ticketing (read + work notes)
Ticketing / ITSM
- Read the originating case
- Attach run evidence to the case
What's at stake
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
Rules of engagement
You may act alone
- Edit and test the playbook
- Run it against the replayed case
- Write work notes
Ask a human first
- Promoting the playbook to production
- Any action node that contains, disables or deletes
Where this sits in a real SOC
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Why this matters
Erasure requests are usually implemented as database deletes. Machine learning copies data sideways — into training sets, feature stores and the weights themselves — so a request that stops at the database leaves the organization still processing a person who asked it to stop.
Concepts
Lineage dates decide the remedy
If the model was trained after the request from a set that still contained the subject, deleting the rows now does not undo the training. The remedy is a cleaned set and a retrain, and that has a cost somebody has to approve.
Hold the pipeline before you clean the data
A scheduled training run during remediation relearns exactly what you are removing. Freeze the pipeline identity first; it is reversible and it stops the problem growing.
Count, do not estimate
'A few rows' is not a finding. Three rows, named dataset, named model version, is a finding with a scope somebody can close.
Objectives graded
- Follow an erasure request past the database into the training data
- Count the residual rows instead of estimating them
- Use lineage dates to decide whether retraining is required
- Hold the pipeline without taking the serving model down needlessly
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve consequential actionpromptapproval gateApprove consequential action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-a-310/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.Attach evidence: range/hst-ai-data01/sessionactionThe gap was found in the data on the host rather than in the privacy desk's ticket.
- 6.Write case field dsrIdactiondsrId → DSR-2291
- 7.Write case field rowsRemainingactionrowsRemaining → 3
- 8.Write case field datasetactiondataset → train-2026-02.jsonl
- 9.Write case field trainedAfterRequestactiontrainedAfterRequest → yes
- 10.enabled on usr-svc-train-pipelineactionusr-svc-train-pipeline.enabled → false
Gate approved — 100%
15 of 15 rubric rules hold.
Gate denied — 92%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A consequential action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass investigation · The gap was found in the data on the host rather than in the privacy desk's ticket.
- pass investigation · The incomplete request was named from its own record.
- pass investigation · The residual exposure was counted rather than estimated.
- pass explanation · The dataset was tied to the model in serving, so the scope covers the derived copy.
- pass configuration · The ordering of request and training run was checked, which is what makes retraining necessary.
- pass safety · The pipeline was held under approval so the next run cannot relearn the subject.
MITRE ATT&CK coverage
Personal data persisting in derived stores after it was supposed to be gone — the same sprawl an attacker exploits, found by the organization first.
| Technique | Name | Tactic |
|---|---|---|
| T1530 | Data from Cloud Storage | Collection |
| T1078 | Valid Accounts | Defense Evasion |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The gap was found in the data on the host rather than in the privacy desk's ticket.
investigation · weight 15 · T1530 Data from Cloud Storage (Collection)
The incomplete request was named from its own record.
investigation · weight 10 · T1530 Data from Cloud Storage (Collection)
The residual exposure was counted rather than estimated.
investigation · weight 10 · T1530 Data from Cloud Storage (Collection)
The dataset was tied to the model in serving, so the scope covers the derived copy.
explanation · weight 10 · T1530 Data from Cloud Storage (Collection)
The ordering of request and training run was checked, which is what makes retraining necessary.
configuration · weight 10 · T1530 Data from Cloud Storage (Collection)
The pipeline was held under approval so the next run cannot relearn the subject.
safety · weight 20 · T1078 Valid Accounts (Defense Evasion)
Common mistakes
- Closing an erasure request on the business systems alone.
- Deleting training rows and considering a model trained from them clean.
- Leaving the training schedule running during remediation.
- Reporting a residual count without naming the dataset and model.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
| approval | Manual task | Prompt | Page |
| note | War Room entry | Note | Case note |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
What transfers
Tracing a subject through every derived copy is the same work for retention limits, legal hold and any data-minimization commitment.