CYBRARY Closure evidence has to be re-testable
Attach the artifact a machine can reproduce: a configuration export, a scan row, a policy query result. If closure cannot be re-tested later, the finding is not closed, it is forgotten.
G-330·Governance evidence·35 min
Closed on paper, open on the host Start this lab
An audit finding was closed three months ago on a screenshot. Last night's configuration scan still shows the setting it was raised about. Prove the drift from the scan, reopen the right finding, and take the host out of the change baseline until it is genuinely fixed.
Mission brief · G-330
Detection & automation engineer
Detection / automation engineer
Business important
Track default
You are acting as
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
How you got here
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Your access
Automation platform (author + test)
Automation platform
- Edit playbooks
- Run against a replayed case
- Inspect run history and context paths
- Not yours: Act on production hosts
- Not yours: Approve your own consequential actions
Ticketing (read + work notes)
Ticketing / ITSM
- Read the originating case
- Attach run evidence to the case
What's at stake
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
Rules of engagement
You may act alone
- Edit and test the playbook
- Run it against the replayed case
- Write work notes
Ask a human first
- Promoting the playbook to production
- Any action node that contains, disables or deletes
Where this sits in a real SOC
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Why this matters
Closed findings are where assurance quietly rots. A screenshot proves what one screen looked like for one second; a scan proves what the host is. When a closed finding disagrees with the current scan, the organization has been attesting to a control it does not have.
Concepts
Drift is a comparison, not an opinion
The scan holds policy value and observed value side by side. Quote both. A finding that says 'password policy is weak' is arguable; one that says 'policy 14, observed 6' is not.
Reopen rather than raise
Raising a new finding hides the failure of the old closure. Reopening AUD-2025-14 keeps the history — closed on weak evidence, reopened by scan — which is the pattern an auditor most wants to see you catch yourself.
Stop attesting while it is broken
Taking the host out of the change baseline is not punishment, it is honesty: the attestation that covers it is currently false.
Objectives graded
- Prove configuration drift from the scan, not from the closure note
- Report the policy value and the observed value side by side
- Reopen the finding the current scan contradicts
- Take the host out of attestation until it is actually fixed
Live walkthrough
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
- 1.Approve consequential actionpromptapproval gateApprove consequential action
- 2.Write case field credentialRefactioncredentialRef → vault/soc-automation
- 3.Attach evidence: case/soar-g-330/evidenceactionThe learner attached at least one linkable piece of evidence to the case.
- 4.Write case field closureNoteactionclosureNote → written
- 5.Attach evidence: range/hst-grc-app05/sessionactionThe drift was read from the scan on the host rather than assumed from the closure note.
- 6.Write case field driftSettingactiondriftSetting → password_min_length
- 7.Write case field policyValueactionpolicyValue → 14
- 8.Write case field observedValueactionobservedValue → 6
- 9.Write case field reopenFindingactionreopenFinding → AUD-2025-14
- 10.isolated on hst-grc-app05actionapproval gatehst-grc-app05.isolated → true
Gate approved — 100%
15 of 15 rubric rules hold.
Gate denied — 82%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
- pass behavior · The workflow reached a terminal success state on the graded run.
- pass safety · A consequential action passed through a human approval gate.
- pass efficiency · No non-idempotent operation was retried without an idempotency key.
- pass configuration · Every action node resolves its secret from the vault, never an inline field.
- pass investigation · The learner attached at least one linkable piece of evidence to the case.
- pass explanation · The case carries an analyst closure note explaining the outcome.
- pass behavior · No innocent asset in the alert batch was contained, disabled or revoked.
- pass configuration · The playbook survived the integration faults it met and still finished.
- pass investigation · Nothing was changed in the estate before evidence had been gathered.
- pass investigation · The drift was read from the scan on the host rather than assumed from the closure note.
- pass investigation · The drifted setting was identified from the scan's own comparison.
- pass investigation · The required value was quoted from policy rather than from habit.
- pass explanation · The observed value was recorded, so the gap is measurable rather than rhetorical.
- pass configuration · The drift was tied back to the finding that was closed against it.
- pass safety · The drifted host was pulled from the change baseline under approval rather than left attested.
MITRE ATT&CK coverage
A weakened authentication control left in place under a closed finding: defenses degraded quietly, with paperwork saying otherwise.
| Technique | Name | Tactic |
|---|---|---|
| T1078 | Valid Accounts | Defense Evasion |
| T1562.001 | Disable or Modify Tools | Defense Evasion |
What each rubric rule proves
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The drift was read from the scan on the host rather than assumed from the closure note.
investigation · weight 15 · T1078 Valid Accounts (Defense Evasion)
The drifted setting was identified from the scan's own comparison.
investigation · weight 10 · T1562.001 Disable or Modify Tools (Defense Evasion)
The required value was quoted from policy rather than from habit.
investigation · weight 10 · T1562.001 Disable or Modify Tools (Defense Evasion)
The observed value was recorded, so the gap is measurable rather than rhetorical.
explanation · weight 10 · T1562.001 Disable or Modify Tools (Defense Evasion)
The drift was tied back to the finding that was closed against it.
configuration · weight 10 · T1078 Valid Accounts (Defense Evasion)
The drifted host was pulled from the change baseline under approval rather than left attested.
safety · weight 20 · T1078 Valid Accounts (Defense Evasion)
Common mistakes
- Treating a screenshot as closure evidence.
- Raising a fresh finding instead of reopening the one that was wrongly closed.
- Describing drift without quoting the policy and observed values.
- Leaving the host inside an attestation you know to be untrue.
Same idea, three vendors
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
| approval | Manual task | Prompt | Page |
| note | War Room entry | Note | Case note |
Where does this value come from?
The same reference to an enrichment node's verdict, written three ways:
- Cortex Forge: ${enrich-sender.verdict}
- Summit SOAR: enrich-sender.verdict
- Storyline: <<enrich-sender.verdict>>
The same concepts in shipping products
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
What transfers
Re-testable closure evidence and scan-versus-policy comparison is how patch compliance, hardening baselines and control attestation are all defended.