You promoted a detection out of the chained hunt and it still has nothing downstream of it. Bind it as a workflow trigger and prove the playbook fires on the query's own output, which is the join every SOC has to make before automation means anything.
Mission brief · B-301
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Automation platform (author + test)
Automation platform
Ticketing (read + work notes)
Ticketing / ITSM
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
You may act alone
Ask a human first
You own the handoff itself: the detection you promote becomes someone else's 3am page, so it has to carry the context they'll need.
Automation earns its keep only when it fires on a detection somebody can defend. Most failed SOAR programs are not bad playbooks — they are good playbooks wired to alerts nobody owns, whose fields nobody traced, so every run starts with an analyst re-deriving the question. This lab is the join: your own hunt becomes the trigger.
The search that starts a workflow promises a shape: these columns, this cardinality, this cadence. Change the query and you have changed the contract every downstream node depends on, which is why a trigger belongs to the detection's version, not to the workflow's.
Each node input resolves from a field the search emitted. Trace them one at a time before the first run: an aggregation that emits a count and a host but not a user cannot feed an identity containment step, and the failure surfaces at 3am rather than at design time.
A hunting result carries unverified values. The run's job is to turn each one into a verdict with provenance, so the case shows why the automation believed what it acted on.
One row per incident implies a single-shot workflow; many rows per incident implies iteration with de-duplication. Reading the shape of your own result set is what stops one intrusion producing forty cases.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
12 of 12 rubric rules hold.
Gate denied — 91%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
The chained hunt's intrusion — password spraying into a lure domain, a downloader and DNS command and control — becomes the trigger the playbook listens on.
| Technique | Name | Tactic |
|---|---|---|
| T1110.003 | Password Spraying | Credential Access |
| T1566.002 | Phishing: Spearphishing Link | Initial Access |
| T1105 | Ingress Tool Transfer | Command and Control |
| T1071.004 | DNS | Command and Control |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A reversible action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The workflow triggers on the detection promoted from the chained hunt, not on a hand-typed alert.
configuration · weight 25 · T1110.003 Password Spraying (Credential Access)
Every field the playbook consumes was traced back to a column the query actually emits.
investigation · weight 20 · T1105 Ingress Tool Transfer (Command and Control)
The indicator carried by the query result was judged by the run.
behavior · weight 15 · T1071.004 DNS (Command and Control)
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| workflow-run | Playbook run | Playbook debug run | Story run |
| node | Task | Block | Action |
| artifact | Indicator | Artifact | Record |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| workflow-run | Playbook run | Playbook run / debug run | Event flow | Logic App run | Playbook execution | Playbook execution | Execution | Workflow execution | Flow execution |
| node | Task | Block | Action | Action / step | Action / step | Action | Step | Function / script | Flow action |
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
Grades what a detection handover review grades: the automation is bound to a named, versioned search, every node input traces to a column that search emits, and the indicators it carried leave the run adjudicated.
Cortex XSOARPalo Alto Networks
A classifier and mapper turn the fetched search result into incident fields; the mapping is the field map this lab asks you to attach.
Splunk SOARSplunk (Cisco)
An ingest saved search plus a CEF field mapping decides what the playbook can see — unmapped columns simply are not there.
TinesTines
An event transform receives the search webhook; the transform is where the column-to-input contract lives.
ServiceNow Security OperationsServiceNow
The security-incident creation rule keys off the query result, so the record's fields are only as good as the mapping.
IBM QRadar SOARIBM
An inbound rule and script populate incident properties from the search payload before any phase begins.
Detection-as-trigger is the same pattern in every stack: saved search, analytic rule, correlation rule or scheduled query, each handing a typed result set to automation that must respect its shape.
CYBRARY