Cybrary ForgeCYBRARY / FORGE
Back to Cybrary Forge

Learning paths

Each path is an ordered walk with real prerequisites: a step unlocks when the labs it depends on are passed. Every step names the NICE Workforce Framework capability it proves, so finishing a path says something a training officer can read.

Come up short on a run? Your remediation plan turns each debrief into the steps that close that gap.

NICE work-role coverage

SOC analyst: query to automation to capstone

Start on the hunt labs learning to ask a question of telemetry, carry that fluency into SOAR so the playbooks you write trigger on queries you can defend, and finish on the capstones that grade the whole arc.

0/15 steps passed · 695 min remaining · next up Hunt: the wire

NICE PD-WRL-001 · Defensive CybersecurityNICE PD-WRL-003 · Incident ResponseNICE PD-WRL-006 · Threat Analysis

1 · Query fluency (0/5)

Five short labs, one telemetry family each. You leave able to write the aggregation, the substring match and the identity timeline without a cheat sheet.

  • qr-01-hunt-the-wireHunt: the wire25 min
    Telemetry queryingThreat hunting
  • qr-02-hunt-the-endpointHunt: the endpoint25 min
    Telemetry queryingThreat hunting
  • qr-03-hunt-the-identityHunt: the identity30 min
    Telemetry queryingThreat hunting
  • qr-07-hunt-the-credentialsHunt: credential theft30 min
    Telemetry queryingThreat hunting
  • qr-10-hunt-the-channelHunt: command and control35 min
    Telemetry queryingThreat hunting

2 · Response automation (0/4)

SOAR opens once the query underneath the playbook is yours. Runs, credentials, artifact discipline and the same incident in three vendor vocabularies.

  • f-101Anatomy of a workflow run25 min
    Response automationIncident triage
    • Needs qr-01-hunt-the-wire — A workflow run is only legible once you can read the telemetry it triggers on.
  • f-102Credentials, scopes and the vault boundary30 min
    Response automation
  • s-101Artifact discipline35 min
    Evidence handlingIncident triage
  • c-201One incident, three vocabularies45 min
    Response automationIncident triage

3 · The chained hunt (0/2)

An intrusion followed end to end in one dialect chosen on purpose.

  • qr-08-hunt-the-spreadHunt: lateral movement60 min
    Telemetry queryingThreat hunting
  • b-301Bridge: from chained hunt to triggered playbook40 min
    Telemetry queryingDetection engineeringResponse automation
    • Needs qr-08-hunt-the-spread — The bridge turns a chained hunt into a trigger, so follow the intrusion first.

4 · Capstones (0/4)

Promote a detection from the hunt, hand it to assurance for validation, then automate the response around it.

  • dr-401ContentOps: validate the promoted rule60 min
    Control assuranceDetection engineering
    • Needs ag-lineage-gap — Validating promoted content means tracing every claim to the tool that made it, which is the lineage drill.
  • k-a01Identity-compromise capstone90 min
    Incident triageResponse automationEvidence handling
  • k-b01Capstone B: query to containment, with a debrief90 min
    Threat huntingResponse automationEvidence handlingControl assurance
    • Needs b-301 — Capstone B is the bridge pattern under blind conditions and real consequence.
    • Needs k-a01 — Capstone B assumes you have already contained an identity compromise once.
    • Needs dr-401 — Capstone B's debrief is graded like an assurance record, not like a chat message.
  • k-c01SOC analyst capstone: live telemetry to containment75 min
    Telemetry queryingThreat huntingIncident triageResponse automationEvidence handling
    • Needs k-b01 — The SOC analyst capstone repeats the arc on live telemetry, so the scripted version comes first.

Detection assurance and recovery

For the engineer who owns whether the control actually fires, and the responder who has to bring an estate back. Assurance pipeline first, then the Northwind recovery arc.

0/6 steps passed · 300 min remaining · next up Truth, reach and align

NICE OG-WRL-012 · Security Control AssessmentNICE PD-WRL-003 · Incident ResponseNICE PD-WRL-007 · Vulnerability Analysis

1 · Pipeline foundations (0/3)

Collection, reach, logic, notification — find the stage that broke.

  • dr-101Truth, reach and align30 min
    Control assurance
  • dr-102Logic that never matched30 min
    Control assurance
  • dr-103Notification that never sent30 min
    Control assurance

2 · Content operations (0/2)

Approval drift, imported content and localisation of detections.

  • dr-401ContentOps60 min
    Control assuranceDetection engineering
    • Needs ag-lineage-gap — Validating promoted content means tracing every claim to the tool that made it, which is the lineage drill.
  • dr-403Imported content operations60 min
    Control assuranceDetection engineering

3 · Recovery capstone (0/1)

Northwind under ransomware: recovery points, wave planning, after-action record.

  • dr-405Northwind recovery assurance90 min
    Control assuranceDetection engineering
    • Needs ran-410 — Recovery assurance re-tests the control uplift the after-action review committed to.
    • Needs ran-420 — Recovery assurance re-tests the full kill-chain outcome, so run the capstone before it is assessed.
    • Needs ir-301 — Assurance re-tests the uplift the incident review committed to, so run the review first.

Ransomware resilience: detect, contain, recover

The Northwind arc in the order a real event forces on you: see the staging in telemetry while it is still cheap to stop, contain it without destroying the evidence, know what would survive, decide which recovery point can be trusted, rebuild identity before anything else, and run the recovery room under a clock.

0/21 steps passed · 1105 min remaining · next up Hunt: the wire

NICE PD-WRL-003 · Incident ResponseNICE OG-WRL-002 · Cybersecurity Policy and PlanningNICE OG-WRL-012 · Security Control Assessment

0 · Basics (0/2)

No ransomware content yet — just the two skills every later stage assumes: asking telemetry a question, and reading a workflow run end to end. Skip this stage only if you can already write the aggregation and the substring match unaided.

  • qr-01-hunt-the-wireHunt: the wire25 min
    Telemetry queryingThreat hunting
  • f-101Anatomy of a workflow run25 min
    Response automationIncident triage
    • Needs qr-01-hunt-the-wire — A workflow run is only legible once you can read the telemetry it triggers on.

1 · See it early (0/3)

Every hour of recovery you avoid is bought here. Ransomware staging is loud in identity, DNS and egress telemetry long before anything encrypts — these are the queries that catch it.

  • qr-11-hunt-the-exfilHunt: exfiltration30 min
    Telemetry queryingThreat hunting
  • qr-03-hunt-the-identityHunt: identity across sources30 min
    Telemetry queryingThreat hunting
  • qr-08-hunt-the-spreadHunt: lateral movement45 min
    Telemetry queryingThreat hunting

2 · Contain without burning the evidence (0/3)

Containment during an encryption event is a scoped, reversible, logged action. The playbook has to isolate the host and preserve exactly what the recovery decision will need later.

  • s-101Artifact discipline35 min
    Evidence handlingIncident triage
  • c-201One incident, three vocabularies45 min
    Response automationIncident triage
  • b-301Bridge: from chained hunt to triggered playbook40 min
    Telemetry queryingDetection engineeringResponse automation
    • Needs qr-08-hunt-the-spread — The bridge turns a chained hunt into a trigger, so follow the intrusion first.

3 · Recovery foundations (0/2)

Before the event: which copies survive an attacker with backup-admin rights, and what depends on what.

  • ran-101Recovery readiness assessment45 min
    Recovery operationsContinuity planning
  • ran-110Blast radius and dependency mapping50 min
    Recovery operationsContinuity planning

4 · Trust decisions (0/2)

The hardest call in the event: the newest copy is the closest to the business and the likeliest to be dirty.

  • ran-120Choosing a recovery point you can defend55 min
    Recovery operationsContinuity planning
  • ran-130Isolated restore and validation55 min
    Recovery operationsContinuity planning
    • Needs s-101 — Isolated restore is an evidence exercise before it is a recovery one — artifact discipline first.

5 · Rebuild and return (0/3)

Golden images, forest recovery with krbtgt double-rotated, then staged reconnection behind gates.

  • ran-201Clean rebuild from a golden image50 min
    Recovery operationsIncident triage
  • ran-210Active Directory forest recovery60 min
    Recovery operationsIncident triage
  • ran-220Staged reconnection and credential rotation50 min
    Recovery operationsIncident triage
    • Needs b-301 — Staged reconnection is gated automation; the bridge lab is where triggered containment is learned.

6 · Run the recovery (0/3)

The recovery room under injects and a clock, then the after-action record that turns it into control uplift.

  • ran-401Recovery Room capstone90 min
    Recovery operationsIncident triageContinuity planning
    • Needs c-201 — The recovery room runs on cross-team communication under a clock, in three vocabularies at once.
  • ran-410After-action review and control uplift45 min
    Continuity planningControl assuranceRisk and policy governance
  • ran-420Full kill-chain capstone: detonation to reconnection150 min
    Recovery operationsContinuity planningThreat huntingIncident triageEvidence handling
    • Needs ran-401 — The kill-chain capstone assumes you have already run the recovery room once under injects.
    • Needs ran-410 — It closes with the same after-action discipline, so the review has to be a habit before it is graded under a clock.

7 · Enterprise scale (0/3)

One recovered estate is not a resilient company. This stage moves the work off the incident and onto the organization: the regulatory clock the event starts, the monitoring that has to keep proving itself between events, and an independent assurance pass over the uplift the after-action review promised.

  • ir-201The 72-hour regulatory clock45 min
    Incident triageEvidence handlingRisk and policy governance
    • Needs ran-401 — The regulatory clock only makes sense once you have run the recovery room it runs alongside.
  • cmp-201Continuous control monitoring, honestly45 min
    Audit and control evidenceRisk and policy governance
    • Needs ran-410 — Continuous monitoring is the after-action control uplift, kept honest between incidents.
    • Needs ag-l20-full-shift — Agent autonomy is a control that has to keep proving itself between shifts, not once at the capstone.
  • dr-405Northwind recovery assurance90 min
    Control assuranceDetection engineering
    • Needs ran-410 — Recovery assurance re-tests the control uplift the after-action review committed to.
    • Needs ran-420 — Recovery assurance re-tests the full kill-chain outcome, so run the capstone before it is assessed.
    • Needs ir-301 — Assurance re-tests the uplift the incident review committed to, so run the review first.

Governance & audit: control, evidence, decision

Assessment the way it actually runs — test a control against its stated design, produce artifacts a third party can re-run, and turn findings into rated, owned, dated risk decisions.

0/11 steps passed · 465 min remaining · next up The management port that came back

NICE OG-WRL-012 · Security Control AssessmentNICE OG-WRL-013 · Systems AuthorizationNICE OG-WRL-002 · Cybersecurity Policy and PlanningNICE OG-WRL-014 · Systems Security Management

1 · Controls and evidence (0/3)

What a control claims, how you test it, and what counts as evidence.

  • sec-101The management port that came back40 min
    Audit and control evidenceControl assurance
  • sec-102Privileged accounts nobody owns40 min
    Audit and control evidenceControl assurance
  • cmp-101The evidence that proves nothing40 min
    Audit and control evidenceRisk and policy governance

2 · Monitoring assurance (0/3)

A logging or detection control is only assured when you can show it collects, matches and notifies.

  • dr-101Truth, reach and align30 min
    Control assurance
  • dr-102Logic that never matched30 min
    Control assurance
  • dr-103Notification that never sent30 min
    Control assurance

3 · Risk and incident governance (0/2)

Findings become risk decisions; incidents become regulatory clocks.

  • cmp-201Continuous control monitoring, honestly45 min
    Audit and control evidenceRisk and policy governance
    • Needs ran-410 — Continuous monitoring is the after-action control uplift, kept honest between incidents.
    • Needs ag-l20-full-shift — Agent autonomy is a control that has to keep proving itself between shifts, not once at the capstone.
  • ir-201The 72-hour clock45 min
    Incident triageEvidence handlingRisk and policy governance
    • Needs ran-401 — The regulatory clock only makes sense once you have run the recovery room it runs alongside.

4 · Assessment capstones (0/3)

Run an assessment end to end, including the recovery control that only a control test can settle.

  • cmp-301Capstone — fieldwork week60 min
    Audit and control evidenceRisk and policy governance
  • ir-301Capstone — the review that changes something60 min
    Incident triageEvidence handlingRisk and policy governance
    • Needs ag-l20-full-shift — The morning-after review only changes something when you have held the shift it reviews.
  • ran-101Backup control testing under assessment45 min
    Recovery operationsContinuity planning

AI security: the agent inside your SOC

Agents now read your alerts, call your tools and close your cases. Learn to treat every part of that pipeline as untrusted input, and to keep autonomy behind a boundary you can defend.

0/30 steps passed · 1285 min remaining · next up The helpful new tool

NICE PD-WRL-001 · Defensive CybersecurityNICE PD-WRL-006 · Threat AnalysisNICE PD-WRL-003 · Incident Response

1 · Basics: how an agent gets used against you (0/3)

Two lightweight failures first — a tool that is too helpful, and two servers claiming one name — plus the habit of shipping a tool that cannot be turned around.

  • ag-tool-poisoningThe helpful new tool35 min
    AI and agent securityControl assurance
  • ag-namespace-squatTwo servers, one name35 min
    AI and agent securityControl assurance
    • Needs ag-tool-poisoning — Name collisions only matter once you can read what a tool description really asks.
  • mcp-f1-safe-toolShip a tool nobody can turn against you30 min
    AI and agent securityDetection engineering
    • Needs ag-tool-poisoning — You write a safe tool by having seen the unsafe one abused first.

2 · Text as untrusted input (0/3)

The first lesson and the one people keep failing: content the agent reads is not instruction — in the alert body, and in the memory that outlives the shift.

  • a-210Prompt injection in an alert body40 min
    AI and agent securityResponse automation
    • Needs ag-tool-poisoning — Prompt injection is the same untrusted-text lesson, arriving through the alert body.
    • Needs f-101 — Injection in a playbook context assumes you know how a workflow run is structured.
  • ag-alert-injectionThe alert that gives orders40 min
    AI and agent securityIncident triage
    • Needs a-210 — The live runner replays the injected alert against a policy you have to edit.
  • ag-memory-contaminationThe note that outlives the shift40 min
    AI and agent securityIncident triage
    • Needs ag-alert-injection — Poisoned memory is injection that survives the shift, so start with the single turn.

3 · The tool catalog is a supply chain (0/4)

Tool descriptions, manifests, registry entries and vendor builds — the supply chain nobody audits.

  • a-220A poisoned tool in the agent's own catalog45 min
    AI and agent securityIncident triage
    • Needs mcp-f1-safe-tool — Auditing a poisoned catalog assumes you know what a well-formed tool looks like.
    • Needs c-201 — Auditing an agent's tool catalog is the same case read three ways, one vocabulary per tool.
  • mcp-f2-harden-poisonedRewrite the poisoned manifest35 min
    AI and agent securityControl assurance
    • Needs a-220 — Rewriting the manifest is the remediation for the poisoning you have already found.
  • ag-registry-integritySame entry, different build35 min
    AI and agent securityControl assurance
    • Needs mcp-f2-harden-poisoned — Registry drift is manifest trust moved from one server to the publishing pipeline.
  • ag-binary-driftThe vendor hotfix35 min
    AI and agent securityVulnerability and patch assurance
    • Needs ag-registry-integrity — A vendor hotfix is the same integrity question about the build behind the entry.

4 · Identity, tenancy and the network boundary (0/6)

Who the agent is when it calls a tool, which tenant's data it can reach, and what its egress path really resolves to.

  • ag-token-audienceOne token, every door40 min
    AI and agent securityControl assurance
    • Needs a-220 — Tool identity comes before token audience: you need to know who is calling what.
  • ag-confused-deputyOne credential, three agents35 min
    AI and agent securityIncident triage
    • Needs ag-token-audience — One credential across three agents is the audience failure with a human in the way.
  • ag-cross-tenant-stateThe case one number down35 min
    AI and agent securityEvidence handling
    • Needs ag-token-audience — Tenant isolation is enforced by the same claims you learned to check on the token.
  • ag-discovery-ssrfThe well-known redirect40 min
    AI and agent securityThreat hunting
    • Needs ag-confused-deputy — Server discovery abuse assumes you can already trace which identity made the call.
  • ag-dns-rebindingThe header says it is us40 min
    AI and agent securityThreat hunting
    • Needs ag-discovery-ssrf — Rebinding is the same egress boundary, re-resolved after the check passed.
  • ag-sandbox-escapeIt only needs a shell35 min
    AI and agent securityIncident triage
    • Needs ag-discovery-ssrf — Escaping the sandbox starts from the reachability you established in discovery.

5 · Oversight, blast radius and provenance (0/7)

Approval ceilings, spend limits, elicitation prompts and the lineage that lets you say which tool produced a claim.

  • ag-blast-radiusContain the site35 min
    AI and agent securityResponse automation
    • Needs ag-memory-contamination — Containment scope is the answer to an agent that has already been steered wrong.
  • ag-cost-exhaustionFourteen lookups a minute30 min
    AI and agent securityControl assurance
    • Needs ag-blast-radius — Spend ceilings are blast radius expressed in budget instead of hosts.
  • ag-elicitation-abuseSession expired30 min
    AI and agent securityIncident triage
    • Needs ag-blast-radius — A fake re-auth prompt only works when approval flow is something you can reason about.
  • ag-data-exfiltrationThe brief that took the credentials with it35 min
    AI and agent securityEvidence handling
    • Needs ag-cross-tenant-state — Exfiltration through a brief is tenancy leakage with the agent as the courier.
  • ag-lineage-gapWhich tool said that?35 min
    AI and agent securityEvidence handling
    • Needs ag-data-exfiltration — Provenance is what lets you say afterwards which tool moved the data.
  • ag-shadow-discoveryNobody filed a ticket for it35 min
    AI and agent securityThreat hunting
    • Needs ag-lineage-gap — Unregistered servers are found by the lineage you learned to demand.
  • ag-x1-samplingThe server that borrowed your model40 min
    AI and agent securityControl assurance
    • Needs ag-lineage-gap — Borrowed sampling is a provenance question about the model, not the tool.

6 · Autonomous shifts, graded (0/4)

A whole shift with the agent working beside you, the adversarial suite it has to survive, and the debrief the morning after.

  • a-230AI security capstone: autonomous triage under oversight75 min
    AI and agent securityResponse automationEvidence handling
    • Needs ag-memory-contamination — The oversight capstone assumes injection and memory poisoning are already understood.
    • Needs ag-binary-drift — Supply-chain trust is one of the ceilings the capstone asks you to defend.
  • mcp-f3-adversarial-runnerSurvive the whole suite45 min
    AI and agent securityDetection engineering
    • Needs a-230 — The adversarial suite grades the hardened posture the capstone made you argue for.
  • ag-shift-capstoneOne whole shift60 min
    AI and agent securityIncident triageResponse automation
    • Needs mcp-f3-adversarial-runner — Survive the suite before you run a whole shift against it live.
  • ag-l20-full-shiftThe whole shift, both chairs75 min
    AI and agent securityIncident triageResponse automationEvidence handling
    • Needs ag-shift-capstone — Both chairs is the full shift again, with a partner and no reset.
    • Needs ag-blast-radius — The generative-attack shift turns on refusing one framed-as-routine containment, so the ceiling has to be a habit first.
    • Needs ag-lineage-gap — The debrief phase is graded on lineage for every claim the agent made.
    • Needs ag-token-audience — The identity phase assumes you already audience-scope a tool token by reflex.

7 · Enterprise scale (0/3)

One held shift is not a governed agent estate. This stage moves the work off the incident and onto the organization: the monitoring that keeps proving agent autonomy between shifts, the review that turns a bad night into a changed control, and an independent assurance pass over what was promised.

  • cmp-201Continuous control monitoring, honestly45 min
    Audit and control evidenceRisk and policy governance
    • Needs ran-410 — Continuous monitoring is the after-action control uplift, kept honest between incidents.
    • Needs ag-l20-full-shift — Agent autonomy is a control that has to keep proving itself between shifts, not once at the capstone.
  • ir-301The review that changes something60 min
    Incident triageEvidence handlingRisk and policy governance
    • Needs ag-l20-full-shift — The morning-after review only changes something when you have held the shift it reviews.
  • dr-405Northwind assurance pass90 min
    Control assuranceDetection engineering
    • Needs ran-410 — Recovery assurance re-tests the control uplift the after-action review committed to.
    • Needs ran-420 — Recovery assurance re-tests the full kill-chain outcome, so run the capstone before it is assessed.
    • Needs ir-301 — Assurance re-tests the uplift the incident review committed to, so run the review first.

Generative attack: the shift an adversary writes for you

One adversary, one estate, one night. Every surface the agent reads — alert bodies, tool manifests, follow-up prompts — is machine-generated against you. The path walks the five phases of that shift in order and ends with the whole thing played and graded.

0/23 steps passed · 965 min remaining

NICE PD-WRL-001 · Defensive CybersecurityNICE PD-WRL-003 · Incident ResponseNICE PD-WRL-006 · Threat Analysis

1 · The queue turns hostile (0/3)

Generated alert bodies that read like operator instructions, and the memory they leave behind. Content the agent reads is not instruction.

  • ag-alert-injectionThe alert that gives orders40 min
    AI and agent securityIncident triage
    • Needs a-210 — The live runner replays the injected alert against a policy you have to edit.
  • ag-memory-contaminationThe note that outlives the shift40 min
    AI and agent securityIncident triage
    • Needs ag-alert-injection — Poisoned memory is injection that survives the shift, so start with the single turn.
  • a-210Prompt injection in an alert body40 min
    AI and agent securityResponse automation
    • Needs ag-tool-poisoning — Prompt injection is the same untrusted-text lesson, arriving through the alert body.
    • Needs f-101 — Injection in a playbook context assumes you know how a workflow run is structured.

2 · A helpful new tool appears (0/4)

The catalog is a supply chain. Descriptions, names and builds are all attacker-writable, and membership is not provenance.

  • ag-tool-poisoningThe helpful new tool35 min
    AI and agent securityControl assurance
  • ag-namespace-squatTwo servers, one name35 min
    AI and agent securityControl assurance
    • Needs ag-tool-poisoning — Name collisions only matter once you can read what a tool description really asks.
  • ag-registry-integritySame entry, different build35 min
    AI and agent securityControl assurance
    • Needs mcp-f2-harden-poisoned — Registry drift is manifest trust moved from one server to the publishing pipeline.
  • mcp-f2-harden-poisonedRewrite the poisoned manifest35 min
    AI and agent securityControl assurance
    • Needs a-220 — Rewriting the manifest is the remediation for the poisoning you have already found.

3 · One token, every door (0/5)

Who the agent is when it calls a tool, whose data it can reach, and where its egress actually resolves.

  • ag-token-audienceOne token, every door40 min
    AI and agent securityControl assurance
    • Needs a-220 — Tool identity comes before token audience: you need to know who is calling what.
  • ag-confused-deputyOne credential, three agents35 min
    AI and agent securityIncident triage
    • Needs ag-token-audience — One credential across three agents is the audience failure with a human in the way.
  • ag-cross-tenant-stateThe case one number down35 min
    AI and agent securityEvidence handling
    • Needs ag-token-audience — Tenant isolation is enforced by the same claims you learned to check on the token.
  • ag-discovery-ssrfThe well-known redirect40 min
    AI and agent securityThreat hunting
    • Needs ag-confused-deputy — Server discovery abuse assumes you can already trace which identity made the call.
  • ag-dns-rebindingThe header says it is us40 min
    AI and agent securityThreat hunting
    • Needs ag-discovery-ssrf — Rebinding is the same egress boundary, re-resolved after the check passed.

4 · The approval that would cost the estate (0/4)

Blast radius, spend and elicitation: make the ceiling a policy instead of a decision you re-take under pressure.

  • ag-blast-radiusContain the site35 min
    AI and agent securityResponse automation
    • Needs ag-memory-contamination — Containment scope is the answer to an agent that has already been steered wrong.
  • ag-cost-exhaustionFourteen lookups a minute30 min
    AI and agent securityControl assurance
    • Needs ag-blast-radius — Spend ceilings are blast radius expressed in budget instead of hosts.
  • ag-elicitation-abuseSession expired30 min
    AI and agent securityIncident triage
    • Needs ag-blast-radius — A fake re-auth prompt only works when approval flow is something you can reason about.
  • ag-data-exfiltrationThe brief that took the credentials with it35 min
    AI and agent securityEvidence handling
    • Needs ag-cross-tenant-state — Exfiltration through a brief is tenancy leakage with the agent as the courier.

5 · The morning after (0/3)

Lineage for every claim, quarantine for the memory the hostile shift wrote, and the adversarial suite run end to end.

  • ag-lineage-gapWhich tool said that?35 min
    AI and agent securityEvidence handling
    • Needs ag-data-exfiltration — Provenance is what lets you say afterwards which tool moved the data.
  • ag-shadow-discoveryNobody filed a ticket for it35 min
    AI and agent securityThreat hunting
    • Needs ag-lineage-gap — Unregistered servers are found by the lineage you learned to demand.
  • mcp-f3-adversarial-runnerSurvive the whole suite45 min
    AI and agent securityDetection engineering
    • Needs a-230 — The adversarial suite grades the hardened posture the capstone made you argue for.

6 · The whole shift, graded (0/1)

All five phases at once at Northwind Logistics, played headlessly and graded phase by phase.

  • ag-l20-full-shiftThe whole shift, both chairs75 min
    AI and agent securityIncident triageResponse automationEvidence handling
    • Needs ag-shift-capstone — Both chairs is the full shift again, with a partner and no reset.
    • Needs ag-blast-radius — The generative-attack shift turns on refusing one framed-as-routine containment, so the ceiling has to be a habit first.
    • Needs ag-lineage-gap — The debrief phase is graded on lineage for every claim the agent made.
    • Needs ag-token-audience — The identity phase assumes you already audience-scope a tool token by reflex.

7 · Enterprise scale (0/3)

Unlocked once the five phases are proven: the monitoring that keeps proving autonomy between shifts, the review that changes a control, and an independent assurance pass.

  • cmp-201Continuous control monitoring, honestly45 min
    Audit and control evidenceRisk and policy governance
    • Needs ran-410 — Continuous monitoring is the after-action control uplift, kept honest between incidents.
    • Needs ag-l20-full-shift — Agent autonomy is a control that has to keep proving itself between shifts, not once at the capstone.
  • ir-301The review that changes something60 min
    Incident triageEvidence handlingRisk and policy governance
    • Needs ag-l20-full-shift — The morning-after review only changes something when you have held the shift it reviews.
  • dr-405Northwind assurance pass90 min
    Control assuranceDetection engineering
    • Needs ran-410 — Recovery assurance re-tests the control uplift the after-action review committed to.
    • Needs ran-420 — Recovery assurance re-tests the full kill-chain outcome, so run the capstone before it is assessed.
    • Needs ir-301 — Assurance re-tests the uplift the incident review committed to, so run the review first.

Cyber defense: the SOC an agent works in

The bridge between the two halves of a modern shift. You already query telemetry and automate a response; here the same queue is half-answered by an agent, so every skill has to survive machine-written input, machine-taken actions and machine-claimed evidence.

0/12 steps passed · 540 min remaining · next up Hunt: the identity

NICE PD-WRL-001 · Defensive CybersecurityNICE PD-WRL-003 · Incident ResponseNICE PD-WRL-006 · Threat Analysis

1 · Ground truth first (0/2)

Nothing an agent says is checkable unless you can already answer the question yourself. Two telemetry labs establish the human baseline the rest of the path measures against.

  • qr-03-hunt-the-identityHunt: the identity30 min
    Telemetry queryingThreat hunting
  • qr-02-hunt-the-endpointHunt: the endpoint35 min
    Telemetry queryingThreat hunting

2 · The queue writes back (0/3)

Alert bodies and case notes are now attacker-writable text an agent reads as instruction. Triage that holds when the input is hostile.

  • ag-alert-injectionThe alert that gives orders40 min
    AI and agent securityIncident triage
    • Needs a-210 — The live runner replays the injected alert against a policy you have to edit.
  • a-210Prompt injection in an alert body40 min
    AI and agent securityResponse automation
    • Needs ag-tool-poisoning — Prompt injection is the same untrusted-text lesson, arriving through the alert body.
    • Needs f-101 — Injection in a playbook context assumes you know how a workflow run is structured.
  • ag-memory-contaminationThe note that outlives the shift40 min
    AI and agent securityIncident triage
    • Needs ag-alert-injection — Poisoned memory is injection that survives the shift, so start with the single turn.

3 · Response you share with a machine (0/3)

Automation with an agent in the loop: the same incident across vendor vocabularies, a blast-radius ceiling that is policy rather than a judgement call, and spend that cannot run away.

  • c-201One incident, three vocabularies45 min
    Response automationIncident triage
  • ag-blast-radiusContain the site35 min
    AI and agent securityResponse automation
    • Needs ag-memory-contamination — Containment scope is the answer to an agent that has already been steered wrong.
  • ag-cost-exhaustionFourteen lookups a minute30 min
    AI and agent securityControl assurance
    • Needs ag-blast-radius — Spend ceilings are blast radius expressed in budget instead of hosts.

4 · Evidence that survives review (0/2)

Every claim traced to the tool that made it, and the detection behind the response validated independently.

  • ag-lineage-gapWhich tool said that?35 min
    AI and agent securityEvidence handling
    • Needs ag-data-exfiltration — Provenance is what lets you say afterwards which tool moved the data.
  • dr-401ContentOps: validate the promoted rule60 min
    Control assuranceDetection engineering
    • Needs ag-lineage-gap — Validating promoted content means tracing every claim to the tool that made it, which is the lineage drill.

5 · Both capstones, one defender (0/2)

The SOC analyst capstone on live telemetry, then the same defender sitting the full generative-attack shift.

  • k-c01SOC analyst capstone: live telemetry to containment75 min
    Telemetry queryingThreat huntingIncident triageResponse automationEvidence handling
    • Needs k-b01 — The SOC analyst capstone repeats the arc on live telemetry, so the scripted version comes first.
  • ag-l20-full-shiftThe whole shift, both chairs75 min
    AI and agent securityIncident triageResponse automationEvidence handling
    • Needs ag-shift-capstone — Both chairs is the full shift again, with a partner and no reset.
    • Needs ag-blast-radius — The generative-attack shift turns on refusing one framed-as-routine containment, so the ceiling has to be a habit first.
    • Needs ag-lineage-gap — The debrief phase is graded on lineage for every claim the agent made.
    • Needs ag-token-audience — The identity phase assumes you already audience-scope a tool token by reflex.

Adversary craft & systems: the host under the detection

Patch state is the precondition for most of what a SOC ever sees. Establish what a machine really runs, decide whether the fix is genuinely applied, and remediate without masking the finding or dropping the service.

0/9 steps passed · 225 min remaining · next up Baseline drift on the internal DNS resolver

NICE PD-WRL-007 · Vulnerability AnalysisNICE OG-WRL-012 · Security Control Assessment

1 · Ground truth on one host (0/2)

What is installed, what is actually running, and why the inventory disagrees with both.

  • pl-101Baseline drift on the internal DNS resolver25 min
    Vulnerability and patch assurance
  • pl-102The upgrade that quietly does nothing25 min
    Vulnerability and patch assuranceControl assurance
    • Needs pl-101 — You cannot spot an upgrade that did nothing until you can read what is installed.

2 · When the patch report lies (0/2)

Dead sources and backported fixes: two different reasons a green report means nothing.

  • pl-103The patch job that never had anything to install25 min
    Vulnerability and patch assuranceControl assurance
    • Needs pl-101 — A patch job with nothing to install is only visible against a known baseline.
  • pl-105Oldstable: the fix that lives somewhere else25 min
    Vulnerability and patch assuranceEvidence handling
    • Needs pl-102 — Oldstable backports are the same 'version looks wrong, is right' reasoning, harder.

3 · Change without an outage (0/2)

Remediation is judged on the service afterwards, and on whether you kept the guardrails on.

  • pl-104The patch that took the resolver down25 min
    Vulnerability and patch assuranceEvidence handling
    • Needs pl-103 — Fixing the source comes before fixing the outage a patch caused.
  • pl-106Patch the RHEL resolver without disabling SELinux25 min
    Vulnerability and patch assuranceControl assurance
    • Needs pl-104 — Patching without taking the service down is the prerequisite for doing it under SELinux.

4 · Servicing state and the software supply chain (0/3)

Installed is not loaded, and a package that looks right is where supply-chain trouble hides.

  • pl-201Patched on paper, unpatched in memory25 min
    Vulnerability and patch assuranceEvidence handling
    • Needs pl-102 — Installed-but-not-running is the pinning lesson applied to memory rather than metadata.
  • pl-202Two agents, one product family25 min
    Vulnerability and patch assuranceControl assurance
    • Needs pl-201 — Windows servicing state repeats the same gap in the registry instead of the package db.
  • pl-203The package that looked right25 min
    Vulnerability and patch assuranceControl assuranceEvidence handling
    • Needs pl-202 — The compound host stacks every earlier failure mode onto one machine.

Protocol analysis: filters to the plant floor

A structured walk up the wire: display filters and streams first, then DNS, then what TLS still shows you, then the IPv6 stack nobody watches, then the IoT protocols that assume a friendly network — ending on the plant floor, where a rogue Modbus master is just one more protocol to read.

0/6 steps passed · 215 min remaining · next up Reps: Follow the Packets

NICE PD-WRL-001 · Defensive CybersecurityNICE PD-WRL-002 · Digital Forensics

1 · Filters and streams (0/1)

The capture discipline everything else stands on: filter a file down to one conversation and read a reassembled stream.

2 · Names that lie (0/1)

DNS is the first protocol every attacker bends. Read a poisoned answer off the wire.

  • lr-79-a-name-that-liesReps: A Name That Lies30 min
    Protocol analysisThreat hunting
    • Needs lr-19-follow-the-packets — DNS poisoning reads as packets first — learn the filter discipline before the protocol trick.

3 · What encryption leaves behind (0/1)

TLS takes the payload away. The handshake — server name, certificate, timing — stays readable, and it is enough.

  • lr-96-what-the-capture-wont-sayReps: What the Capture Won't Say35 min
    Protocol analysis
    • Needs lr-79-a-name-that-lies — TLS visibility is about what a capture cannot show, which only lands once you know what it can.

4 · The other stack (0/1)

Dual-stack hosts speak two protocols and most watchlists read one. Find the exfil that only exists on IPv6.

  • lr-97-the-other-stackReps: The Other Stack35 min
    Protocol analysis
    • Needs lr-96-what-the-capture-wont-say — The IPv6 drill hides traffic on a second stack, so bring the metadata-first habit from TLS.

5 · Protocols that trust the room (0/1)

MQTT and CoAP were built for constrained devices, not secrecy. Read a rogue subscriber straight off the broker's wire.

  • lr-98-the-chatty-sensorReps: The Chatty Sensor30 min
    Protocol analysis
    • Needs lr-97-the-other-stack — MQTT and CoAP are new wire formats; the v6 drill taught you to read a protocol from its bytes.

6 · Capstone: the plant floor (0/1)

Modbus on a flat control network, a master that should not exist, and a wrong answer that breaks the plant. Everything above, applied where it matters.

  • ics-plant-floorThe Rogue Master on the Plant Floor45 min
    Protocol analysisControl assurance
    • Needs lr-98-the-chatty-sensor — The plant-floor capstone puts Modbus on top of everything the protocol drills covered.