A finance workstation has to come off the network, and an automated isolation is not something you fire blind. Build the Splunk SOAR playbook with a prompt block for approval, a child playbook for evidence collection and a clean rollback path.
Mission brief · S-240
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Automation platform (author + test)
Automation platform
Ticketing (read + work notes)
Ticketing / ITSM
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
You may act alone
Ask a human first
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
Automated containment is where automation stops being convenient and starts being dangerous. Every consequential action needs a gate, a reversal plan and a record.
In Summit SOAR this is called Prompt.
Read-only enrichment should never wait on a human. Disabling an account at month-end close should always wait. Classify the action, then place the gate — the rubric scores that reasoning, not the number of gates.
Before you automate an action, write down how it is undone and how long that takes. If you cannot, you have written an outage generator, not a response.
In Summit SOAR this is called Note.
Who approved, on what evidence, at what time. Without it the action is indistinguishable from an attack when someone reviews it next quarter.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
11 of 11 rubric rules hold.
Gate denied — 75%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
LSASS memory dumping on a finance workstation, with SMB admin-share reuse as the next hop you cut off.
| Technique | Name | Tactic |
|---|---|---|
| T1003.001 | OS Credential Dumping: LSASS Memory | Credential Access |
| T1059.001 | Command and Scripting Interpreter: PowerShell | Execution |
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The affected host is isolated at end state.
behavior · weight 25 · T1021.002 SMB/Windows Admin Shares (Lateral Movement)
The dumper hash was judged before containment.
investigation · weight 20 · T1003.001 OS Credential Dumping: LSASS Memory (Credential Access)
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| approval | Manual task | Prompt | Page |
| note | War Room entry | Note | Case note |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
Grades containment the way change management does: blast radius classified, human gate in front of the consequential action, documented rollback, attribution on the case.
Splunk SOARSplunk (Cisco)
A Prompt block in front of block-ip / disable-user is the gate; note the approver and evidence on the container.
Cortex XSOARPalo Alto Networks
Data collection task with a defined SLA; the War Room keeps the attribution automatically.
Torq HyperautomationTorq
Approval steps land in chat, which is convenient and also where attribution quietly disappears if you never write it back to the case.
Microsoft Sentinel + Logic AppsMicrosoft
Approval action before Defender isolate-machine; automation rules can otherwise fire estate-wide.
ServiceNow Security OperationsServiceNow
Approval activity on the SIR, with the change record as the rollback plan.
Blast radius, reversibility, attribution — the same three questions govern change management in any engineering org.
CYBRARY