Cybrary ForgeCYBRARY / FORGE
Back to Labs
Curriculum
N-401·Cross-platform·55 min

Prove the Northwind network is actually segmented Start this lab

Audit finding NW-AUD-114 says nobody can demonstrate the corporate VLAN is separated from the server farm, the DMZ and the internet. You get a seat on an ordinary endpoint and nothing else, so prove the design from the wire, including the endpoint holding a session it should not have.

Mission brief · N-401

Tier 3 analyst on the incident response bench

Tier 3 — deep host and forensics
Business important
Track default

You are acting as

the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity

How you got here

The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.

Your access

  • EDR console (detections + live response)

    Endpoint detection & response

    • Read the detection and process tree
    • Look up host criticality, owner and VIP flags
    • Open a live-response session on the host
    • Contain the host over the agent channel
    • Not yours: Disable user accounts (that's the identity team)
    • Not yours: Delete evidence

  • Live-response shell on the affected host

    Host shell session

    • Read the filesystem, logs and running state
    • Collect a triage package
    • Not yours: Reboot or reimage without owner approval

What's at stake

The affected host

Owner: The system's business owner, named on the asset record

Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.

Rules of engagement

You may act alone

  • Investigate from the live-response session
  • Collect evidence and triage packages
  • Contain a standard-criticality host

Ask a human first

  • Containing a mission-critical host — asset owner and on-call manager first
  • Disabling a user identity — identity team, and HR/legal if it looks like an insider

Why this matters

Analysts inherit networks nobody documented. Segmentation is either provable from the wire or it is an assumption, and assumptions are what incident reports get wrong: an analyst who believes the server farm is isolated will not check the path an intruder actually took. This case makes the network answer for itself, using the same discovery commands an intruder would run on day one.

Concepts

The routing table is the first honest map you get

`ip route` names the connected network, the default gateway and every static leg the host knows. Everything beyond that first hop is inference until a trace confirms it, which is why the gateway and the inter-VLAN router are separate findings.

Filtered is a finding, not a failure

A scan that comes back filtered has just proven a control works. Record the rule number that dropped the probe: an audit finding is closed by a specific deny, not by a sentence claiming the VLANs are probably separated.

Egress is usually a single named device

Estates that look flat internally are often tightly controlled outbound, with one proxy permitted to leave. Finding that device tells you where web traffic is logged, and any host talking straight out on 443 is by definition an exception worth chasing.

Isolating an endpoint on discovery evidence still needs a gate

The workstation holding the external session is contained under approval like any other host. Network evidence supports the action; it does not replace the authorization for it.

Objectives graded

  • Read a real routing table, ARP table and resolver configuration from the endpoint
  • Walk the path across the core switch and perimeter firewall with traceroute and scanning
  • Prove which zone crossings are permitted, name the deny rule, and contain the exception

Live walkthrough

The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.

  1. 1.Approve reversible actionpromptapproval gateApprove reversible action
  2. 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
  3. 3.Attach evidence: case/soar-n-401/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
  4. 4.Write case field closureNoteactionclosureNote → written
  5. 5.Attach evidence: range/hst-nw-net21/sessionactionThe analyst worked the live network from the endpoint instead of describing it from memory.
  6. 6.Write case field localCidractionlocalCidr → 10.42.24.0/24
  7. 7.Write case field interVlanRouteractioninterVlanRouter → core-rtr-01
  8. 8.Write case field resolverIpactionresolverIp → 10.42.10.11
  9. 9.Write case field egressProxyactionegressProxy → proxy-01
  10. 10.Write case field blockingRuleactionblockingRule → 125
  11. 11.isolated on hst-nw-net34actionapproval gatehst-nw-net34.isolated → true
  12. 12.Write case field beaconEndpointactionbeaconEndpoint → 10.42.24.34
  13. 13.Attach evidence: case/soar-n-401/timelineactionA written segmentation record was filed: zones, routing path, permitted egress and the exception found.
  14. 14.Write case field seatRamGbactionseatRamGb → 8
  15. 15.Write case field seatDiskGbactionseatDiskGb → 512

Gate approved — 100%

20 of 20 rubric rules hold.

Gate denied — 86%

Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.

  • pass behavior · The workflow reached a terminal success state on the graded run.
  • pass safety · A reversible action passed through a human approval gate.
  • pass efficiency · No non-idempotent operation was retried without an idempotency key.
  • pass configuration · Every action node resolves its secret from the vault, never an inline field.
  • pass investigation · The learner attached at least one linkable piece of evidence to the case.
  • pass explanation · The case carries an analyst closure note explaining the outcome.
  • pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
  • pass configuration · The playbook survived the integration faults it met and still finished.
  • pass investigation · Nothing was changed in the estate before evidence had been gathered.
  • pass investigation · The analyst worked the live network from the endpoint instead of describing it from memory.
  • pass investigation · The connected subnet was read from the interface and routing table.
  • pass investigation · Inter-VLAN routing was proven with a trace rather than assumed.
  • pass investigation · The resolver in use was identified from the host's own configuration.
  • pass behavior · The single permitted egress path was located, which is what makes the rule base enforceable.
  • pass behavior · The audit finding is answered with a specific deny rule, by number.
  • pass behavior · The endpoint holding an unauthorized external session is isolated at end state.
  • pass explanation · The unauthorized egress was attributed to a specific host on the analyst's own VLAN.
  • pass explanation · A written segmentation record was filed: zones, routing path, permitted egress and the exception found.
  • pass investigation · The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
  • pass investigation · Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

MITRE ATT&CK coverage

A segmentation review run the way an intruder would run it: enumerate the local network configuration, discover which systems answer across VLANs, read which sessions the estate already permits, and find the endpoint quietly holding a channel to the internet.

TechniqueNameTactic
T1046Network Service DiscoveryDiscovery
T1018Remote System DiscoveryDiscovery
T1016System Network Configuration DiscoveryDiscovery
T1049System Network Connections DiscoveryDiscovery
T1071.001Application Layer Protocol: Web ProtocolsCommand and Control

What each rubric rule proves

  • The workflow reached a terminal success state on the graded run.

    behavior · weight 20 · T1046 Network Service Discovery (Discovery)

  • A reversible action passed through a human approval gate.

    safety · weight 15 · T1046 Network Service Discovery (Discovery)

  • No non-idempotent operation was retried without an idempotency key.

    efficiency · weight 10 · T1018 Remote System Discovery (Discovery)

  • Every action node resolves its secret from the vault, never an inline field.

    configuration · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

  • The learner attached at least one linkable piece of evidence to the case.

    investigation · weight 10 · T1018 Remote System Discovery (Discovery)

  • The case carries an analyst closure note explaining the outcome.

    explanation · weight 10 · T1016 System Network Configuration Discovery (Discovery)

  • No innocent asset in the alert batch was contained, disabled or revoked.

    behavior · weight 15 · T1046 Network Service Discovery (Discovery)

  • The playbook survived the integration faults it met and still finished.

    configuration · weight 15 · T1018 Remote System Discovery (Discovery)

  • Nothing was changed in the estate before evidence had been gathered.

    investigation · weight 10 · T1049 System Network Connections Discovery (Discovery)

  • The analyst worked the live network from the endpoint instead of describing it from memory.

    investigation · weight 10 · T1018 Remote System Discovery (Discovery)

  • The connected subnet was read from the interface and routing table.

    investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)

  • Inter-VLAN routing was proven with a trace rather than assumed.

    investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)

  • The resolver in use was identified from the host's own configuration.

    investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)

  • The single permitted egress path was located, which is what makes the rule base enforceable.

    behavior · weight 10 · T1049 System Network Connections Discovery (Discovery)

  • The audit finding is answered with a specific deny rule, by number.

    behavior · weight 15 · T1046 Network Service Discovery (Discovery)

  • The endpoint holding an unauthorized external session is isolated at end state.

    behavior · weight 15 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

  • The unauthorized egress was attributed to a specific host on the analyst's own VLAN.

    explanation · weight 10 · T1049 System Network Connections Discovery (Discovery)

  • A written segmentation record was filed: zones, routing path, permitted egress and the exception found.

    explanation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

  • The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

    investigation · weight 3

  • Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

    investigation · weight 3

Common mistakes

  • Describing the design from the onboarding wiki instead of from `ip route` and traceroute.
  • Reporting that endpoint-to-endpoint SMB is blocked without naming the rule that blocks it.
  • Assuming every server can reach the internet because the browser works — the proxy does.
  • Missing the external session because the scan stopped at the server VLAN.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

ConceptCortex ForgeSummit SOARStoryline
artifactIndicatorArtifactRecord
caseIncidentContainerCase
noteWar Room entryNoteCase note
approvalManual taskPromptPage

Where does this value come from?

The same reference to an enrichment node's verdict, written three ways:

  • Cortex Forge: ${enrich-sender.verdict}
  • Summit SOAR: enrich-sender.verdict
  • Storyline: <<enrich-sender.verdict>>

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.

ConceptCortex XSOARXSOAR 8.xSplunk SOARSplunk SOAR 6.x (formerly Phantom)TinesTines (2026 cloud)Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026)Google SecOps SOARSecOps SOAR (formerly Siemplify)Swimlane TurbineTurbine (2026)Torq HyperautomationTorq (2026)IBM QRadar SOARQRadar SOAR (Resilient) 51.xServiceNow Security OperationsSecOps (Flow Designer era)
artifactIndicatorArtifact (CEF fields)Event payload fieldEntityEntityField / correlation valueEvent fieldArtifactObservable
caseIncidentContainerCaseIncidentCaseRecordCaseIncidentSecurity incident (SIR)
noteWar Room entryNoteCase noteCommentCase wall commentCommentCase commentNoteWork note
approvalManual (data collection) taskPrompt blockPage (form) / Send to ChatApproval action (Teams / email)Manual actionTask / approval actionApproval step (Torq Chat / Slack)Manual task / phase gateApproval activity

What transfers

The same four questions — what subnet am I in, who routes, who resolves, who may leave — orient you on any unfamiliar estate, including during an incident when the network diagram is out of date.

Back to the curriculumRun this lab as a live case