Reading the whole knowledge base Start this lab

Why this matters

The data an intruder wants is often sitting in a wiki or a reporting database, readable with credentials that were granted legitimately and never reviewed.

Concepts

Objectives graded

• Measure how many pages and tables the account actually read
• Tell the overnight walk apart from the analytics service doing its job
• Cut the account's access without stopping the legitimate reader

MITRE ATT&CK coverage

An account reading an entire knowledge base and reporting database in one overnight pass.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The learner measured the read instead of describing it.

  investigation · weight 20 · T1213 Data from Information Repositories (Collection)

• The session was judged against the account's normal working pattern.

  investigation · weight 15 · T1213.002 Data from Information Repositories: Sharepoint (Collection)

• The account's access was cut while the legitimate reader kept working.

  behavior · weight 20 · T1078 Valid Accounts (Defense Evasion)

Common mistakes

• Closing the case because the access was authorized.
• Suspending the analytics service alongside the account and taking out the morning reporting run.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.