CYBRARY Scope before containment
State which identities, mailboxes and hosts are in scope, with the evidence for each. Containment that outruns scope either misses persistence or takes out the business.
K-A01·Capstone·90 min
Capstone A — identity compromise, end to end Start this lab
An identity compromise runs from a risky sign-in to a mailbox rule to a lateral attempt. Author the workflow, bind scoped credentials, run it under approval, work the case, and defend your score with evidence.
Mission brief · K-A01
Incident response lead
Incident response lead
Business important
Track default
You are acting as
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
How you got here
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
Your access
EDR console (detections + live response)
Endpoint detection & response
- Read the detection and process tree
- Look up host criticality, owner and VIP flags
- Open a live-response session on the host
- Contain the host over the agent channel
- Not yours: Disable user accounts (that's the identity team)
- Not yours: Delete evidence
Live-response shell on the affected host
Host shell session
- Read the filesystem, logs and running state
- Collect a triage package
- Not yours: Reboot or reimage without owner approval
What's at stake
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
Rules of engagement
You may act alone
- Investigate from the live-response session
- Collect evidence and triage packages
- Contain a standard-criticality host
Ask a human first
- Containing a mission-critical host — asset owner and on-call manager first
- Disabling a user identity — identity team, and HR/legal if it looks like an insider
Where this sits in a real SOC
You are running the incident, not just the console: expect to decide who gets woken, what leadership is told, and when to hand technical work to the bench.
Why this matters
The capstone is the job: an identity compromise with a mailbox rule and a lateral attempt, worked end to end under approval, and then defended out loud with evidence.
Concepts
Eradicate persistence, not just access
Disabling the account without removing the forwarding rule leaves the attacker reading mail. Both end states are graded because both matter.
Run the published version
The graded run must execute the promoted version in the live environment. A draft result is not a result.
Defend the score
The closure note ties each action to the evidence that justified it. That is the artifact a manager, a customer or an auditor actually consumes.
Objectives graded
- Author and publish a workflow under review
- Contain identity and mailbox persistence
- Defend the score from evidence, not from memory
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve consequential actionpromptapproval gateApprove consequential action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-k-a01/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.enabled on usr-l.ferraraactionusr-l.ferrara.enabled → false
- 6.forwarding on mbx-l.ferraraactionmbx-l.ferrara.forwarding → false
- 7.Attach evidence: case/scope-statementactionScope was stated with evidence for each affected entity.
- 8.Write case field environmentactionenvironment → live
Gate approved — 100%
13 of 13 rubric rules hold.
Gate denied — 92%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A consequential action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass behavior · The compromised account is disabled at end state.
- pass behavior · Attacker persistence in the mailbox is removed.
- pass investigation · Scope was stated with evidence for each affected entity.
- pass configuration · The graded run executed the published version in the live environment.
MITRE ATT&CK coverage
Risky sign-in, mailbox persistence, token reuse and a lateral attempt: the full identity-compromise chain.
| Technique | Name | Tactic |
|---|---|---|
| T1078 | Valid Accounts | Defense Evasion |
| T1114.003 | Email Collection: Email Forwarding Rule | Collection |
| T1021.001 | Remote Desktop Protocol | Lateral Movement |
| T1550.001 | Use Alternate Authentication Material: Application Access Token | Defense Evasion |
| T1003.001 | OS Credential Dumping: LSASS Memory | Credential Access |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The compromised account is disabled at end state.
behavior · weight 20 · T1078 Valid Accounts (Defense Evasion)
Attacker persistence in the mailbox is removed.
behavior · weight 15 · T1114.003 Email Collection: Email Forwarding Rule (Collection)
Scope was stated with evidence for each affected entity.
investigation · weight 20 · T1021.001 Remote Desktop Protocol (Lateral Movement)
The graded run executed the published version in the live environment.
configuration · weight 15 · T1550.001 Use Alternate Authentication Material: Application Access Token (Defense Evasion)
Common mistakes
- Containing the account and calling it done while persistence remains.
- Grading a draft run.
- A closure note that narrates clicks instead of reasoning.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| case | Incident | Container | Case |
| approval | Manual task | Prompt | Page |
| note | War Room entry | Note | Case note |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| case | Incident | Container | Case | Incident | Case | Record | Case | Incident | Security incident (SIR) |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
How this rubric maps to production SOC work
The capstone grades what a shift handover grades: published (not draft) automation ran in the live environment, containment held, and every claim in the scope statement has linked evidence.
Cortex XSOARPalo Alto Networks
Content is promoted between dev and production tenants; running a draft is a finding in itself.
Splunk SOARSplunk (Cisco)
Playbooks have draft and active states — an active-version run is the only one that counts.
TinesTines
Change control and story versions in a production team, promoted from a draft team.
ServiceNow Security OperationsServiceNow
The flow must be published and the SIR closed with work notes that stand up to review.
IBM QRadar SOARIBM
Phases must be completed with tasks closed; an open phase means the incident is not actually resolved.
What transfers
Scope, contain, eradicate, recover, explain — the incident-response spine, with automation carrying the repetitive parts.