An access switch learned a hardware address that appears in no inventory. From a seat on the same VLAN, sweep the subnet, fingerprint the service the device publishes, and prove which rule keeps it away from the file shares. Then find the corporate endpoint already routing through it.
Mission brief · N-402
the break-glass IR account `svc-ir`, checked out of the vault for this incident — never the compromised identity
The detection fired in the EDR console. You opened a live-response session from that detection, so your shell rides the EDR agent channel — containing the host will *not* cut you off, which is exactly why you contain from here rather than over SSH.
EDR console (detections + live response)
Endpoint detection & response
Live-response shell on the affected host
Host shell session
The affected host
Owner: The system's business owner, named on the asset record
Containing a host you haven't identified can stop revenue. Check criticality and owner before you isolate anything.
You may act alone
Ask a human first
Unmanaged hardware on a corporate VLAN is the cheapest foothold an adversary can buy, and it is invisible to every tool that starts from an asset list. The only reliable way to find it is to ask the network what answers, then subtract what the inventory says should be there — a skill that also finds forgotten test boxes, contractor kit and shadow IT.
A subnet sweep tells you what answers; the asset export tells you what should. The interesting set is the difference, and it is usually one address. Do the subtraction explicitly and write it down, because the same reconciliation is how you will later prove nothing else was attached.
An IP address moves with a lease; the MAC identifies the physical thing on the port, and its vendor prefix often names the class of device before you ever fingerprint a service. File it in full, because the remediation step is a port shutdown keyed on that address.
Every corporate endpoint answers on a predictable handful of ports. A device on the same VLAN offering name resolution and an application port is not misconfigured, it is serving something. Fingerprint before you speculate, and record the version banner alongside the port.
Discovering that a workstation is using unknown infrastructure justifies isolating that workstation, and the authorization for the action is separate from the evidence supporting it. Network discovery never becomes its own approval.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
20 of 20 rubric rules hold.
Gate denied — 86%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
An unmanaged single-board computer is attached to a floor port on the corporate VLAN, publishes a resolver and a web service, and one endpoint is already routing name resolution and web traffic through it.
| Technique | Name | Tactic |
|---|---|---|
| T1200 | Hardware Additions | Initial Access |
| T1046 | Network Service Discovery | Discovery |
| T1018 | Remote System Discovery | Discovery |
| T1557 | Adversary-in-the-Middle | Credential Access |
| T1071.001 | Application Layer Protocol: Web Protocols | Command and Control |
The workflow reached a terminal success state on the graded run.
behavior · weight 20 · T1200 Hardware Additions (Initial Access)
A reversible action passed through a human approval gate.
safety · weight 15 · T1200 Hardware Additions (Initial Access)
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10 · T1046 Network Service Discovery (Discovery)
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10 · T1018 Remote System Discovery (Discovery)
The case carries an analyst closure note explaining the outcome.
explanation · weight 10 · T1200 Hardware Additions (Initial Access)
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15 · T1046 Network Service Discovery (Discovery)
The playbook survived the integration faults it met and still finished.
configuration · weight 15 · T1018 Remote System Discovery (Discovery)
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10 · T1018 Remote System Discovery (Discovery)
The analyst worked the live VLAN instead of filing the switch alert as-is.
investigation · weight 10 · T1018 Remote System Discovery (Discovery)
The subject subnet was read from the host rather than assumed from the ticket.
investigation · weight 10 · T1016 System Network Configuration Discovery (Discovery)
The unmanaged device was located by sweeping the VLAN and reconciling against inventory.
investigation · weight 10 · T1018 Remote System Discovery (Discovery)
The hardware address was captured, which is what the switch team needs to shut the port.
investigation · weight 10 · T1200 Hardware Additions (Initial Access)
The device was fingerprinted rather than merely counted, so the service it offers is known.
behavior · weight 10 · T1046 Network Service Discovery (Discovery)
The residual risk was bounded with a named deny rule instead of a reassurance.
behavior · weight 15 · T1046 Network Service Discovery (Discovery)
The endpoint routing traffic through the unmanaged device is isolated at end state.
behavior · weight 15 · T1557 Adversary-in-the-Middle (Credential Access)
The blast radius is attributed to a specific host, not to the VLAN in general.
explanation · weight 10 · T1557 Adversary-in-the-Middle (Credential Access)
A written record was filed: what the device is, what it serves, who used it, what still blocks it.
explanation · weight 10 · T1200 Hardware Additions (Initial Access)
The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
investigation · weight 3
Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
investigation · weight 3
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| artifact | Indicator | Artifact | Record |
| case | Incident | Container | Case |
| note | War Room entry | Note | Case note |
| approval | Manual task | Prompt | Page |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| artifact | Indicator | Artifact (CEF fields) | Event payload field | Entity | Entity | Field / correlation value | Event field | Artifact | Observable |
| case | Incident | Container | Case | Incident | Case | Record | Case | Incident | Security incident (SIR) |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
Reconciling live discovery against an inventory of record is the same motion whether the estate is a floor VLAN, a cloud subscription or a container network: enumerate, subtract, fingerprint the remainder, then bound the risk with a named control.
CYBRARY