Cybrary ForgeCYBRARY / FORGE
Back to SOAR Range

SOAR certification

0% complete

Your progress through every SOAR track — foundations, cross-platform, bridge, AI security, governance evidence and the capstones — and the badge issued when all of them are passed.

0 of 83 labs passed

Next up: F-101 — Anatomy of a workflow run

Foundations
0 of 2
F-101Anatomy of a workflow runnot started
F-102Credentials, scopes and the vault boundarynot started
Cross-platform
0 of 54
C-201One incident, three vocabulariesnot started
C-320Idempotency and the duplicate-ticket trapnot started
C-340The ticket burst: answering a kerberoasting passnot started
C-341The web process that started a shellnot started
C-342The account list nobody asked fornot started
C-343The account with pre-authentication offnot started
C-344The share read end to endnot started
C-345The archive in a temp foldernot started
C-346The swipe at the backupsnot started
C-347Reading the passwords out of memorynot started
C-348One password against every accountnot started
C-349A certificate in somebody else's namenot started
C-350The cluster handed over its secretsnot started
C-351A ticket that crossed the trustnot started
C-352Someone is reading the roomnot started
C-353The app they said yes tonot started
C-354Reading the whole knowledge basenot started
C-355Trusted tool, untrusted payloadnot started
C-356The printer gave up the directory accountnot started
C-357The invoice that asked to be enablednot started
C-358Someone else's memorynot started
C-359A command written so you would not read itnot started
C-360Persistence with no file to findnot started
C-361The hour that is missing from the lognot started
C-362Approve, approve, approvenot started
C-363Signed in without ever signing innot started
C-364A tunnel inside ordinary trafficnot started
C-365Out through the personal drivenot started
C-366Nothing to decryptnot started
H-201Prove it before you isolate: hands-on containmentnot started
H-301Northwind portal breach: detect, contain, debriefnot started
H-302Northwind order portal breach: the Windows sidenot started
H-303SELinux went quiet on the Northwind API servernot started
H-304The key that let itself back into the Northwind build hostnot started
H-305The upload handler that loaded a rootkit on nw-web03not started
H-306Three kinds of persistence from one macro on NW-HR01not started
H-307A new administrator and a cleared Security log on NW-DC01not started
N-401Prove the Northwind network is actually segmentednot started
N-402Find the rogue device wired into the corporate VLANnot started
N-403Rebuild the Northwind rule base from the wirenot started
N-404Follow a breach across the subnets it crossednot started
N-405Walk the physical path: why the yard is slownot started
N-410Read the air: signal, interference and airtime on the yard radionot started
V-510Stand the platform up: two bare hosts to the written baselinenot started
V-520The platform you inherited: measure it before you touch itnot started
V-530Break it on purpose: watch the platform answernot started
V-540The store stopped answering: a pause, a loss, and the mess left behindnot started
V-550The console went dark: hung agents, a dead clock and a full log disknot started
V-560Migrations stall at 21%: frame sizes and half-configured bondingnot started
V-570Four tickets, one resolver: name resolution, profile drift and a stale gold imagenot started
H-610Stand the Hyper-V cluster up: two nodes to the written baselinenot started
H-620The Hyper-V cluster you inherited: measure it before you touch itnot started
H-630Break the Hyper-V cluster on purpose, and watch every number movenot started
H-640Three tickets, one resolver: Kerberos, baseline drift and a stale gold imagenot started
Bridge
0 of 1
B-301From chained hunt to triggered playbooknot started
AI security
0 of 13
A-210Prompt injection in an alert bodynot started
A-220A poisoned tool in the agent's own catalognot started
A-230AI security capstone — autonomous triage under oversightnot started
A-240The confused deputy: an agent spending someone else's authoritynot started
A-250A summary job that published the customer booknot started
A-255Memory contamination: a rule nobody wrotenot started
A-260Blast radius: prove how far the agent's account gotnot started
A-270Written by a machine: the quote that changed the bank detailsnot started
A-280Adverse impact: the model that ranks the shiftnot started
A-290The obligation nobody wrote down: classifying an AI systemnot started
A-300The model nobody signednot started
A-310The erasure that never reached the modelnot started
A-320Telling the regulator what happenednot started
Governance evidence
0 of 3
G-310The access review that approved itselfnot started
G-320The processor nobody paperednot started
G-330Closed on paper, open on the hostnot started
Capstones
0 of 4
K-A01Capstone A — identity compromise, end to endnot started
K-B01Capstone B — query to containment, with a written debriefnot started
K-C01SOC Analyst Capstone — live telemetry to containmentnot started
P-401Write the playbook: author, debug, submitnot started
xsoar
0 of 2
X-101Incident layout and context pathsnot started
X-210Sub-playbooks and reversible containmentnot started
splunk-soar
0 of 2
S-101Containers, artifacts and CEF disciplinenot started
S-240Prompts, child playbooks and host isolationnot started
tines
0 of 2
T-101Storyboard basics and event lineagenot started
T-330Change control: test story to live storynot started