CYBRARY The vault boundary
A credential is referenced, never typed. A vault reference resolves at execution and is redacted in run evidence, logs and exports; an inline value leaks into all three forever and cannot be rotated without editing content.
F-102·Foundations·30 min
Credentials, scopes and the vault boundary Start this lab
A workflow needs to reach a protected system without ever holding the secret that opens it. Bind it to a scoped credential, run the ten-stage health test, and prove no secret reaches a node field, a log or an export.
Mission brief · F-102
Detection & automation engineer
Detection / automation engineer
Business important
Track default
You are acting as
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
How you got here
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Your access
Automation platform (author + test)
Automation platform
- Edit playbooks
- Run against a replayed case
- Inspect run history and context paths
- Not yours: Act on production hosts
- Not yours: Approve your own consequential actions
Ticketing (read + work notes)
Ticketing / ITSM
- Read the originating case
- Attach run evidence to the case
What's at stake
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
Rules of engagement
You may act alone
- Edit and test the playbook
- Run it against the replayed case
- Write work notes
Ask a human first
- Promoting the playbook to production
- Any action node that contains, disables or deletes
Where this sits in a real SOC
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Why this matters
Automation holds more privilege than any analyst, and it uses it unattended at 3am. Where the secret lives, what scope it carries and whether its use is auditable is the whole security posture of the platform.
Concepts
Instances carry scope, connectors carry capability
The connector says what is possible; the instance says what this deployment may do, with which account, against which tenant. Two instances of the same connector should routinely hold different scopes — read-only for enrichment, write for containment.
The health ladder
Test connectivity in stages — network, TLS, auth, scope, quota, and so on — and read the *first* failing stage. Diagnosing from the last error is how teams rotate a perfectly good credential for two hours.
Rotation is an audited event
Rotating through the vault leaves an audit record tying the new material to a person and a time. Rotating by editing a node leaves nothing.
Objectives graded
- Bind an instance to a scoped, write-only credential
- Localize a failure to one health stage
- Show that no secret appears in run evidence
- Prove it on the runner: find the instance file that still holds an inline key
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve reversible actionpromptapproval gateApprove reversible action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-f-102/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 6.Attach evidence: audit/credential.rotatedactionRotation was performed through the vault and audited.
- 7.Attach evidence: node/health-test/outputactionThe learner used the health ladder to localize the failing stage.
- 8.Write case field inlineSecretFileactioninlineSecretFile → /etc/soc-automation/instances/edr-isolate.yaml
- 9.Write case field healthStageFailedactionhealthStageFailed → scope-check
- 10.Write case field seatRamGbactionseatRamGb → 8
- 11.Write case field seatDiskGbactionseatDiskGb → 512
Gate approved — 100%
16 of 16 rubric rules hold.
Gate denied — 93%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A reversible action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass configuration · The action node references a vault credential rather than an inline secret.
- pass safety · Rotation was performed through the vault and audited.
- pass investigation · The learner used the health ladder to localize the failing stage.
- pass investigation · The analyst found the instance definition that still carries a pasted key.
- pass investigation · The analyst localized the failure to a single health stage on the runner.
- pass investigation · The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
- pass investigation · Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
MITRE ATT&CK coverage
Automation credentials in plaintext are the classic in-file credential exposure an intruder harvests first.
| Technique | Name | Tactic |
|---|---|---|
| T1552.001 | Unsecured Credentials: Credentials In Files | Credential Access |
| T1555 | Credentials from Password Stores | Credential Access |
| T1078 | Valid Accounts | Defense Evasion |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A reversible action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The action node references a vault credential rather than an inline secret.
configuration · weight 25 · T1552.001 Unsecured Credentials: Credentials In Files (Credential Access)
Rotation was performed through the vault and audited.
safety · weight 20 · T1555 Credentials from Password Stores (Credential Access)
The learner used the health ladder to localize the failing stage.
investigation · weight 15 · T1078 Valid Accounts (Defense Evasion)
The analyst found the instance definition that still carries a pasted key.
investigation · weight 15
The analyst localized the failure to a single health stage on the runner.
investigation · weight 15
The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
investigation · weight 3
Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
investigation · weight 3
Common mistakes
- Pasting a token into a node field 'just to test it' — the run record keeps it.
- Granting one omnipotent instance because scoping two felt like extra work.
- Reading the last health-stage failure instead of the first.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| credential | Credential | Asset credential | Credential |
| connector-instance | Integration instance | Asset | Resource |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| credential | Credential | Asset configuration secret | Credential | Managed identity / connection secret | Integration parameter (secret) | Vault secret | Secret | App host secret | Credential record |
| connector-instance | Integration instance | Asset | Credential + resource pair | API connection | Integration instance (environment-scoped) | Asset | Integration connection | App configuration (app.config) | Connection & credential alias |
How this rubric maps to production SOC work
Scores the control every real audit tests: secrets resolve from a vault at run time, rotation is recorded, and no secret appears in run output, logs or exports.
Cortex XSOARPalo Alto Networks
Integration instance credentials come from the credential store; encrypted parameters never render back into the War Room.
Splunk SOARSplunk (Cisco)
Asset configuration holds the secret; playbooks reference the asset name, never the value.
TinesTines
Credentials are referenced as <<CREDENTIAL.name>> and are redacted in event logs by design.
Microsoft Sentinel + Logic AppsMicrosoft
Prefer managed identity over API connection secrets; secure inputs/outputs must be set or the run history leaks the value.
Torq HyperautomationTorq
Secrets are vault-backed and masked in execution logs; rotating in the vault rotates every workflow at once.
ServiceNow Security OperationsServiceNow
Use a credential alias so the credential record is swappable without editing the flow.
What transfers
Vault reference, scoped instance, staged health test, audited rotation — the four ideas are identical in XSOAR, Splunk SOAR and Tines, only the screens move.