CYBRARY Mission brief · B-301
Detection engineer moving a detection into response
You are acting as
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
How you got here
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Your access
Automation platform (author + test)
Automation platform
- Edit playbooks
- Run against a replayed case
- Inspect run history and context paths
- Not yours: Act on production hosts
- Not yours: Approve your own consequential actions
Ticketing (read + work notes)
Ticketing / ITSM
- Read the originating case
- Attach run evidence to the case
What's at stake
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
Rules of engagement
You may act alone
- Edit and test the playbook
- Run it against the replayed case
- Write work notes
Ask a human first
- Promoting the playbook to production
- Any action node that contains, disables or deletes
Where this sits in a real SOC
You own the handoff itself: the detection you promote becomes someone else's 3am page, so it has to carry the context they'll need.
How much help do you want?
Objectives stay open and every step explains why it matters before it tells you what to run. Hints are free.
Graded case walkthrough
Open a lab as a live case and advance it one node at a time. The score beside each step is the lab rubric re-evaluated against what the engine actually did.
You promoted a detection out of the chained hunt and it still has nothing downstream of it. Bind it as a workflow trigger and prove the playbook fires on the query's own output, which is the join every SOC has to make before automation means anything.