Write the playbook: author, debug, submit Start this lab

Why this matters

Most analysts meet SOAR as a finished graph somebody else built, and learn only which button advances it. The skill that actually transfers is writing the thing: reading an unhandled event off the runner, deciding what the automation is allowed to do on its own, and expressing that decision precisely enough that a machine will execute it at three in the morning without you.

Concepts

Objectives graded

• Read the live event queue on the persistent automation host and find the unhandled event
• Write the response playbook yourself in the playbook editor: evidence, approval, containment, verdict
• Debug it until the review reports no blind actions and no unreachable steps, then submit it for grading

MITRE ATT&CK coverage

An unsigned service on a finance workstation beacons to an external listener on a fixed interval; the response is written as automation, so the containment, the approval and the verdict all come from the playbook rather than from an analyst clicking.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• A consequential action passed through a human approval gate.

  safety · weight 15 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10 · T1105 Ingress Tool Transfer (Command and Control)

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15 · T1543.003 Create or Modify System Process: Windows Service (Persistence)

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15 · T1105 Ingress Tool Transfer (Command and Control)

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The queue was read on the automation host itself rather than taken on trust.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The unhandled event was identified from the runner's own log.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The beacon peer was read out of the queued event, not guessed.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The affected asset was named before anything was contained.

  investigation · weight 5 · T1543.003 Create or Modify System Process: Windows Service (Persistence)

• The already-judged benign event was recognized and excluded from the automation.

  safety · weight 10 · T1105 Ingress Tool Transfer (Command and Control)

• The playbook the learner wrote actually contained the implicated workstation.

  behavior · weight 15 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The maintenance server named by the benign event was left alone.

  safety · weight 15 · T1543.003 Create or Modify System Process: Windows Service (Persistence)

• The playbook wrote a verdict back to the case, so the queue ends in a decided state.

  explanation · weight 10 · T1041 Exfiltration Over C2 Channel (Exfiltration)

• The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

  investigation · weight 3

• Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

  investigation · weight 3

Common mistakes

• Writing the containment step first and adding the evidence step afterwards, which the dry-run review flags as blind action.
• Retrying an isolate call because a connector wobbled, and isolating twice.
• Automating on every event in the queue instead of the one the evidence names.
• Leaving the case with no verdict, so the queue never reaches a decided state.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.