CYBRARY A story is a graph of events
In Storyline this is called Story.
There is no program counter. Each action fires on an event and emits an event; branching is a filter on the stream, not an if-statement in a script.
T-101·Storyline·30 min·Taught in Storyline (Tines 2025)
Storyboard basics and event lineage Start this lab
Tines works in stories, and every event in one carries its own lineage. Build a compact story that receives an alert, enriches it and opens a case, reading each event in the viewer to trace where its values came from.
Mission brief · T-101
Detection & automation engineer
Detection / automation engineer
Business important
Track default
You are acting as
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
How you got here
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Your access
Automation platform (author + test)
Automation platform
- Edit playbooks
- Run against a replayed case
- Inspect run history and context paths
- Not yours: Act on production hosts
- Not yours: Approve your own consequential actions
Ticketing (read + work notes)
Ticketing / ITSM
- Read the originating case
- Attach run evidence to the case
What's at stake
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
Rules of engagement
You may act alone
- Edit and test the playbook
- Run it against the replayed case
- Write work notes
Ask a human first
- Promoting the playbook to production
- Any action node that contains, disables or deletes
Where this sits in a real SOC
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Why this matters
Event-driven, storyboard-style automation makes the data flow obvious and the state implicit. That trade is powerful once you learn to think in events instead of steps.
Concepts
Event paths reference upstream results
In Storyline this is called Event path.
You address the emitting action's payload directly. Rename an action and every downstream reference to it breaks — naming is load-bearing here in a way it is not elsewhere.
Idempotency by re-emission
Re-running a story replays events. Anything with an external side effect must be safe to replay, or keyed so the second attempt is a no-op.
Objectives graded
- Compose a four-action story
- Reference event paths correctly
- Trace a case field to its source event
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve reversible actionpromptapproval gateApprove reversible action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-t-101/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.Write case field eventPathsUsedactioneventPathsUsed → yes
- 6.Attach evidence: node/get-alert/outputactionThe learner traced the case field back to its originating event.
Gate approved — 100%
11 of 11 rubric rules hold.
Gate denied — 90%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A reversible action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass configuration · Actions reference event paths rather than duplicated literals.
- pass investigation · The learner traced the case field back to its originating event.
MITRE ATT&CK coverage
Cloud storage discovery against an exposed bucket — the reconnaissance that precedes bulk collection.
| Technique | Name | Tactic |
|---|---|---|
| T1580 | Cloud Infrastructure Discovery | Discovery |
| T1530 | Data from Cloud Storage | Collection |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A reversible action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
Actions reference event paths rather than duplicated literals.
configuration · weight 20 · T1580 Cloud Infrastructure Discovery (Discovery)
The learner traced the case field back to its originating event.
investigation · weight 20 · T1530 Data from Cloud Storage (Collection)
Common mistakes
- Thinking in sequential steps and being surprised when parallel branches both fire.
- Renaming actions late and breaking every downstream path.
- Replaying a story that sends notifications.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| workflow | Playbook | Playbook | Story |
| context-path | Context path | Datapath | Event path |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| workflow | Playbook | Playbook | Story | Playbook (Logic App) | Playbook | Playbook | Workflow | Workflow (BPMN) | Flow / subflow |
| context-path | Context path (${...}) | Datapath | Formula (<<path.to.value>>) | Expression (@{body('step')}) | Placeholder ([Entity.Identifier]) | Reference ($record.field) | Expression ({{ .event.field }}) | Rule/script object (incident.properties) | Data pill |
How this rubric maps to production SOC work
Scores event-driven thinking: each step is a pure transform of the event it received, so replaying the event reproduces the outcome.
TinesTines
Actions emit events; there is no hidden run state to lean on, which is exactly why re-emitting reproduces the result.
Torq HyperautomationTorq
Steps read {{ .event }}; a step that depends on wall-clock or on a previous side effect is not replayable.
Microsoft Sentinel + Logic AppsMicrosoft
Logic App triggers carry the payload; reading current state mid-run instead is what makes reruns diverge.
What transfers
Event-driven pipelines behave identically in stream processing and CI systems: fan-out is free, ordering is not guaranteed, replay must be safe.