A scoring vendor has been live on customer data for months. The register says one thing, the egress log says another, and a confirmed breach notice is sitting in the folder with a statutory clock already running. Work out the exposure and stop the transfer without cutting off the vendors that are properly papered.
Mission brief · G-320
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Automation platform (author + test)
Automation platform
Ticketing (read + work notes)
Ticketing / ITSM
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
You may act alone
Ask a human first
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Third-party exposure is where most regulated data actually sits. The register tells you what someone intended; the egress log tells you what happened. When the two disagree, the organization is measured against the log — and on a clock that started the moment the breach was confirmed.
A vendor register is a set of claims maintained by people. Egress logs are produced by machines. Reconcile them before you brief anyone: an onward transfer nobody declared is both a contract failure and, usually, a notification trigger.
No processing agreement means no lawful basis for the transfer that already happened. That is why the remedy is to stop the transfer first and paper it second, rather than the reverse.
Statutory windows run from the point of confirmation, not from the end of your investigation. Work out the hours remaining early, because it decides whether you are writing a full report or an initial notification with gaps marked unknown.
Disabling every vendor connection during an incident costs the business more than the incident. Contain the identity that carried the data, and say in the note why the others were left running.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
15 of 15 rubric rules hold.
Gate denied — 92%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
Customer data reaching an undeclared third party through a trusted integration — the trusted-relationship path, seen from the governance side.
| Technique | Name | Tactic |
|---|---|---|
| T1199 | Trusted Relationship | Initial Access |
| T1530 | Data from Cloud Storage | Collection |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The exposure was established from the register and the egress log rather than from the vendor's assurance pack.
investigation · weight 15 · T1199 Trusted Relationship (Initial Access)
The unpapered processor was named from the register itself.
investigation · weight 10 · T1199 Trusted Relationship (Initial Access)
The undeclared onward transfer was found by comparing claim with evidence.
investigation · weight 10 · T1530 Data from Cloud Storage (Collection)
The obligation was quoted from the text rather than from memory.
explanation · weight 10 · T1199 Trusted Relationship (Initial Access)
The clock was worked from confirmation, so the deadline is real rather than aspirational.
configuration · weight 10 · T1199 Trusted Relationship (Initial Access)
The unpapered transfer was stopped under approval while the papered processors kept working.
safety · weight 20 · T1199 Trusted Relationship (Initial Access)
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
| approval | Manual task | Prompt | Page |
| note | War Room entry | Note | Case note |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
Reconciling a register against machine evidence, then working a statutory clock from confirmation, is the same discipline for data transfers, breach reporting and any regulated notification.
CYBRARY