CYBRARY Scope covers data and identity
Cloud exposure has two containment surfaces — the object store and the identity that could reach it. Naming only one leaves either the data readable or the credential live, and the rubric grades both end states.
K-B01·Capstone·90 min
Capstone B — query to containment, with a written debrief Start this lab
The whole arc lands in one sitting, from exposure to written debrief. Hunt the exposure, trigger the playbook from your own detection, contain under approval, then file the debrief the cohort report reads, with coverage claimed, blind spot named and owner assigned.
Mission brief · K-B01
Incident response lead
Incident response lead
Business important
Track default
You are acting as
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
How you got here
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
Your access
EDR console (detections + live response)
Endpoint detection & response
- Read the detection and process tree
- Look up host criticality, owner and VIP flags
- Open a live-response session on the host
- Contain the host over the agent channel
- Not yours: Disable user accounts (that's the identity team)
- Not yours: Delete evidence
Live-response shell on the affected host
Host shell session
- Read the filesystem, logs and running state
- Collect a triage package
- Not yours: Reboot or reimage without owner approval
What's at stake
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
Rules of engagement
You may act alone
- Investigate from the live-response session
- Collect evidence and triage packages
- Contain a standard-criticality host
Ask a human first
- Containing a mission-critical host — asset owner and on-call manager first
- Disabling a user identity — identity team, and HR/legal if it looks like an insider
Where this sits in a real SOC
You are running the incident, not just the console: expect to decide who gets woken, what leadership is told, and when to hand technical work to the bench.
Why this matters
This capstone grades the arc rather than a skill: a detection you promoted, automation you triggered from it, containment that survived an approval gate, and a written debrief that an instructor and a cohort report both consume. Every step exists in production, and the debrief is the one most teams skip.
Concepts
Consequential actions stay gated at capstone level
Nothing about a capstone earns a bypass. Revoking public access and disabling a service identity both carry business impact, so both pass a gate whose decision is recorded next to the evidence that justified it.
A debrief is graded content, not a courtesy
The debrief states what happened, what is now automated, what remains uncovered, and who owns the gap. It is the artifact the cohort report reduces across seats, so vagueness in it becomes vagueness in the class's coverage picture.
Coverage claims need a blind spot
A debrief claiming complete coverage is almost always wrong and always unfalsifiable. Naming the path the automation still misses is what makes the rest of the claim credible.
Objectives graded
- Trigger containment from a detection you promoted yourself
- Contain cloud exposure and the identity behind it under approval
- File a debrief the cohort report can grade
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve consequential actionpromptapproval gateApprove consequential action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-k-b01/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.Write case field triggerQueryactiontriggerQuery → sa-301/promoted
- 6.public on hst-bucket-reportsactionhst-bucket-reports.public → false
- 7.enabled on usr-svc-etlactionusr-svc-etl.enabled → false
- 8.Attach evidence: case/scope-statementactionScope was stated with linked evidence for every entity named.
- 9.Attach evidence: case/debriefactionA written debrief was filed: what happened, what is now automated, what is still uncovered.
Gate approved — 100%
14 of 14 rubric rules hold.
Gate denied — 93%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A consequential action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass configuration · The graded run was started by the learner's own promoted detection.
- pass behavior · The exposed storage container is no longer public at end state.
- pass behavior · The service identity that reached the data is disabled pending review.
- pass investigation · Scope was stated with linked evidence for every entity named.
- pass explanation · A written debrief was filed: what happened, what is now automated, what is still uncovered.
MITRE ATT&CK coverage
Cloud infrastructure discovery finds an exposed container, a standing service identity collects from it and exfiltrates over an alternative protocol; you cut both and write down what is still uncovered.
| Technique | Name | Tactic |
|---|---|---|
| T1580 | Cloud Infrastructure Discovery | Discovery |
| T1530 | Data from Cloud Storage | Collection |
| T1078.004 | Valid Accounts: Cloud Accounts | Defense Evasion |
| T1098.003 | Additional Cloud Roles | Persistence |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | Exfiltration |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The graded run was started by the learner's own promoted detection.
configuration · weight 15 · T1580 Cloud Infrastructure Discovery (Discovery)
The exposed storage container is no longer public at end state.
behavior · weight 20 · T1530 Data from Cloud Storage (Collection)
The service identity that reached the data is disabled pending review.
behavior · weight 15 · T1078.004 Valid Accounts: Cloud Accounts (Defense Evasion)
Scope was stated with linked evidence for every entity named.
investigation · weight 20 · T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol (Exfiltration)
A written debrief was filed: what happened, what is now automated, what is still uncovered.
explanation · weight 20 · T1098.003 Additional Cloud Roles (Persistence)
Common mistakes
- Containing the storage container and leaving the service identity enabled.
- Filing a debrief that narrates the run instead of stating coverage and gaps.
- Triggering the graded run from a stock alert rather than the promoted detection.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| case | Incident | Container | Case |
| approval | Manual task | Prompt | Page |
| note | War Room entry | Note | Case note |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| case | Incident | Container | Case | Incident | Case | Record | Case | Incident | Security incident (SIR) |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
How this rubric maps to production SOC work
Grades the full sprint deliverable: detection promoted and bound, containment applied to both the data surface and the identity behind it under approval, and a debrief naming residual coverage with an owner.
Cortex XSOARPalo Alto Networks
Cloud containment via a cloud connector under a manual task approval, closed with an incident summary that carries the residual risk.
Splunk SOARSplunk (Cisco)
A promoted active playbook contains the bucket and the identity, with the analyst prompt block as the approval record.
TinesTines
A production story with a page for approval, then a report action that files the debrief into the team's channel of record.
ServiceNow Security OperationsServiceNow
Containment tasks and a post-incident review record, where residual risk becomes a tracked item with an assignee.
IBM QRadar SOARIBM
The recover and review phases must close with notes; an unnamed gap keeps the incident open in practice.
What transfers
Hunt, promote, trigger, contain, debrief — the same loop a detection engineering team runs every sprint, whichever SIEM and automation platform it happens to own.