Dispatch say the yard crawls and the cabling record is four years stale. Sit at the yard seat, ping each segment, walk the path hop by hop and read the physical layer off the kit: what each leg is made of, how far it runs and what it negotiated. Then say which of the two faults the yard actually feels.
Mission brief · N-405
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
EDR console (detections + live response)
Endpoint detection & response
Live-response shell on the affected host
Host shell session
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
You may act alone
Ask a human first
Latency has causes you can measure. Distance, the medium the signal crosses and the speed the link negotiated set a floor no tuning gets under, and knowing that floor is what stops a site complaint turning into a pointless application investigation.
Signal crosses glass and copper at roughly two thirds the speed of light, so ten kilometers is a tenth of a millisecond round trip. Distance sets a floor, but on a short-haul estate it is almost never the thing a user feels — the access medium usually is.
A number alone proves nothing. The rack path and the far-site path measured the same way, minutes apart, is what turns 'it feels slow' into a finding.
Every frame on a path is clocked onto its slowest leg. Upgrading anything else on that path changes nothing a user can feel.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
16 of 16 rubric rules hold.
Gate denied — 92%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
Mapping an estate's real paths — segments, routed hops and the links between sites — is the same discovery work an intruder does, done deliberately and written down.
| Technique | Name | Tactic |
|---|---|---|
| T1046 | Network Service Discovery | Discovery |
| T1016 | System Network Configuration Discovery | Discovery |
| T1049 | System Network Connections Discovery | Discovery |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A reversible action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The path was measured from the yard seat rather than described from the ticket.
investigation · weight 15 · T1049 System Network Connections Discovery (Discovery)
The seat's own access medium was identified before anything upstream was blamed.
investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
The longest leg on the path back to head office was named from the path view.
investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
The length of that leg was read off the model rather than estimated.
investigation · weight 10 · T1046 Network Service Discovery (Discovery)
The speed the over-length run actually negotiated was recorded.
configuration · weight 10 · T1046 Network Service Discovery (Discovery)
The routed hops on the path were counted from a real traceroute.
investigation · weight 10 · T1046 Network Service Discovery (Discovery)
Nothing in the estate was contained or disabled over a performance ticket.
safety · weight 10
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
Any slow-site complaint answers the same way: measure the path, name the physical floor, then look for what sits above it.
CYBRARY