An EDR detection arrives in a shape Phantom cannot work with. Normalize it into a container with correctly typed CEF artifacts, and use Data Preview to catch the null datapath before it breaks the run.
Mission brief · S-101
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Automation platform (author + test)
Automation platform
Ticketing (read + work notes)
Ticketing / ITSM
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
You may act alone
Ask a human first
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Container-and-artifact platforms make the data model visible, and normalized fields are what let one action work across five log sources. Learning the field names is learning the platform.
In Summit SOAR this is called Container.
The container is the case; artifacts are the structured observables inside it. Actions run against artifacts, so an artifact created with the wrong field name is invisible to the automation that needs it.
In Summit SOAR this is called Artifact.
`sourceAddress` means the same thing regardless of which sensor produced it. That normalization is precisely why one block-IP action can serve every detection you own.
Results are addressed positionally — action, result index, data element. Getting comfortable reading those paths is how you stop guessing which of five returned rows you are acting on.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
11 of 11 rubric rules hold.
Gate denied — 91%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
An EDR detection of scripted credential access, normalized into artifacts before anyone acts on it.
| Technique | Name | Tactic |
|---|---|---|
| T1059.001 | Command and Scripting Interpreter: PowerShell | Execution |
| T1003.001 | OS Credential Dumping: LSASS Memory | Credential Access |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A reversible action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
Artifacts carry correct CEF field names, so downstream blocks resolve.
configuration · weight 25 · T1059.001 Command and Scripting Interpreter: PowerShell (Execution)
The null datapath was found in Data Preview before the run failed.
investigation · weight 20 · T1003.001 OS Credential Dumping: LSASS Memory (Credential Access)
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| case | Incident | Container | Case |
| artifact | Indicator | Artifact | Record |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| case | Incident | Container | Case | Incident | Case | Record | Case | Incident | Security incident (SIR) |
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
Scores normalized field usage: an artifact written into the wrong field is invisible to every action that needed it, and the rubric catches exactly that.
Splunk SOARSplunk (Cisco)
CEF fields (sourceAddress, destinationDnsDomain, fileHash) are the interface; custom fields break the reusable actions.
Cortex XSOARPalo Alto Networks
Indicator types and reputation are the equivalent normalization layer.
Google SecOps SOARGoogle Cloud
Entities are typed at ingestion; a mistyped entity never reaches the enrichment playbook.
IBM QRadar SOARIBM
Artifact types drive which functions and rules are even offered on the incident.
Normalized-field thinking is the same instinct as writing detections against a common schema — it is portability, bought early.
CYBRARY