CYBRARY Classify every operation
Safe (naturally idempotent), keyed (idempotent given a key) or unsafe (never auto-retry). The classification is a property of the operation, not of your confidence in it.
C-320·Cross-platform·35 min
Idempotency and the duplicate-ticket trap Start this lab
A flaky ITSM connector times out after it has already created the ticket. Make the retry safe to repeat, because retrying it wrong leaves two tickets in the estate and the duplicate is graded.
Mission brief · C-320
Tier 3 analyst on the incident response bench
Tier 3 — deep host and forensics
Business important
Track default
You are acting as
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
How you got here
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
Your access
EDR console (detections + live response)
Endpoint detection & response
- Read the detection and process tree
- Look up host criticality, owner and VIP flags
- Open a live-response session on the host
- Contain the host over the agent channel
- Not yours: Disable user accounts (that's the identity team)
- Not yours: Delete evidence
Live-response shell on the affected host
Host shell session
- Read the filesystem, logs and running state
- Collect a triage package
- Not yours: Reboot or reimage without owner approval
What's at stake
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
Rules of engagement
You may act alone
- Investigate from the live-response session
- Collect evidence and triage packages
- Contain a standard-criticality host
Ask a human first
- Containing a mission-critical host — asset owner and on-call manager first
- Disabling a user identity — identity team, and HR/legal if it looks like an insider
Why this matters
Retry semantics are the least glamorous and most expensive part of automation. One unsafe retry can double a containment, a payment or a page.
Concepts
Recovery after ambiguity
When you cannot tell whether the write landed, read before you write again. A verification query is always cheaper than a duplicate side effect.
Proving absence of duplicates
Closing the loop means showing the target system holds exactly one record. That evidence is what the rubric wants.
Objectives graded
- Classify operations by idempotency
- Recover from an ambiguous timeout
- Prove no duplicate side effect exists
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve reversible actionpromptapproval gateApprove reversible action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-c-320/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.state on tkt-cloud-2210actiontkt-cloud-2210.state → open
Gate approved — 100%
11 of 11 rubric rules hold.
Gate denied — 91%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A reversible action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass behavior · Exactly one ticket exists for the incident at end state.
- pass safety · The retry carried an idempotency key or was correctly blocked.
MITRE ATT&CK coverage
Exposed cloud data drives an ITSM response; duplicated side effects are how automation causes its own impact.
| Technique | Name | Tactic |
|---|---|---|
| T1530 | Data from Cloud Storage | Collection |
| T1657 | Financial Theft | Impact |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A reversible action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
Exactly one ticket exists for the incident at end state.
behavior · weight 25 · T1530 Data from Cloud Storage (Collection)
The retry carried an idempotency key or was correctly blocked.
safety · weight 20 · T1657 Financial Theft (Impact)
Common mistakes
- Marking an operation safe because it has 'usually' been fine.
- Retrying on a timeout without a key or a verification read.
- Claiming no duplicate without querying the downstream system.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| case | Incident | Container | Case |
| alert | Alert | Event | Event |
| artifact | Indicator | Artifact | Record |
| workflow | Playbook | Playbook | Story |
| workflow-run | Playbook run | Playbook debug run | Story run |
| node | Task | Block | Action |
| connector | Integration | App | Credential-backed action |
| connector-instance | Integration instance | Asset | Resource |
| credential | Credential | Asset credential | Credential |
| approval | Manual task | Prompt | Page |
| child-workflow | Sub-playbook | Child playbook | Sub-story |
| context-path | Context path | Datapath | Event path |
| queue | Incidents | Events | Cases |
| task | Work Plan task | Task | Case task |
| note | War Room entry | Note | Case note |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| case | Incident | Container | Case | Incident | Case | Record | Case | Incident | Security incident (SIR) |
| alert | Alert | Event | Event | Alert | Alert | Inbound record / signal | Trigger event | Escalated offense / alert | Security alert |
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
| workflow | Playbook | Playbook | Story | Playbook (Logic App) | Playbook | Playbook | Workflow | Workflow (BPMN) | Flow / subflow |
| workflow-run | Playbook run | Playbook run / debug run | Event flow | Logic App run | Playbook execution | Playbook execution | Execution | Workflow execution | Flow execution |
| node | Task | Block | Action | Action / step | Action / step | Action | Step | Function / script | Flow action |
| connector | Integration | App | HTTP Request action / Tool | Connector | Integration | Integration | Integration | App | Spoke |
| connector-instance | Integration instance | Asset | Credential + resource pair | API connection | Integration instance (environment-scoped) | Asset | Integration connection | App configuration (app.config) | Connection & credential alias |
| credential | Credential | Asset configuration secret | Credential | Managed identity / connection secret | Integration parameter (secret) | Vault secret | Secret | App host secret | Credential record |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
| child-workflow | Sub-playbook | Child playbook | Send to Story | Nested Logic App | Block | Sub-playbook | Nested workflow | Called workflow | Subflow |
| context-path | Context path (${...}) | Datapath | Formula (<<path.to.value>>) | Expression (@{body('step')}) | Placeholder ([Entity.Identifier]) | Reference ($record.field) | Expression ({{ .event.field }}) | Rule/script object (incident.properties) | Data pill |
| queue | Incidents view | Event / Case list | Cases | Incidents grid | Cases queue | Application workspace | Cases | Incident list | SIR queue |
| task | Work Plan task | Task (workbook phase) | Case task | Incident task | Task | Task | Case task | Task (within phase) | Response task |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
How this rubric maps to production SOC work
Grades migration fidelity: the ported workflow must reach the same end state under the target platform's own execution and approval semantics, not merely look similar.
Splunk SOARSplunk (Cisco)
Port the datapath addressing, then re-derive severity rather than trusting the source platform's field.
Cortex XSOARPalo Alto Networks
Rebuild sub-playbook inputs explicitly; inherited context does not travel.
Microsoft Sentinel + Logic AppsMicrosoft
Re-implement branch logic with run-after conditions — the closest analogue to a decision node.
Swimlane TurbineSwimlane
Model the case schema first; a port that skips the record design ends up with fields nothing can query.
What transfers
Exactly-once is a myth; at-least-once plus idempotency is the achievable design, in SOC automation as everywhere else.