A credential-harvest incident lands in XSOAR and the work has to survive being reused tomorrow. Work it through the Work Plan and the War Room, driving every field from context paths instead of hard-coded values.
Mission brief · X-101
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Automation platform (author + test)
Automation platform
Ticketing (read + work notes)
Ticketing / ITSM
The credential-harvest playbook and its incident layout
Owner: SOC manager — signs off before this runs unattended
Hard-coded values look fine on the case you built them against and silently target the wrong entity on the next one. Context paths are the difference.
You may act alone
Ask a human first
This lab grades automation design, not triage. The analyst who works the phish and the engineer who automates it are different seats — do the phishing triage lab if you want the triage half.
In an incident-centric platform, the layout is the analyst's whole world. Driving fields from context rather than typing values is what lets one workflow serve a thousand incidents.
In Cortex Forge this is called Incident.
Everything — tasks, evidence, notes, timers — hangs off one incident object. Work that happens outside it did not happen, because the grader, the metrics and the next shift can only see the object.
In Cortex Forge this is called Context path.
A hard-coded hostname works once. A path expression works for every incident of that type. Any literal you type in a node is a future outage.
In Cortex Forge this is called Work Plan task.
Tasks record what the workflow meant to do and who cleared each gate; the run record records what actually happened. You need both to defend a decision.
In Cortex Forge this is called War Room entry.
Notes are timestamped, attributable and exportable into the incident record — write them as if a regulator will read one line out of context, because they will.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
11 of 11 rubric rules hold.
Gate denied — 90%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
Credential harvest via a lookalike SSO domain, worked as an incident with indicator adjudication.
| Technique | Name | Tactic |
|---|---|---|
| T1566.002 | Phishing: Spearphishing Link | Initial Access |
| T1204.001 | User Execution: Malicious Link | Execution |
| T1078 | Valid Accounts | Defense Evasion |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A reversible action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
Incident severity is bound to a context path, not typed in.
configuration · weight 20 · T1078 Valid Accounts (Defense Evasion)
The lure domain was enriched to a malicious verdict before action.
investigation · weight 20 · T1566.002 Phishing: Spearphishing Link (Initial Access)
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| case | Incident | Container | Case |
| context-path | Context path | Datapath | Event path |
| task | Work Plan task | Task | Case task |
| note | War Room entry | Note | Case note |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| case | Incident | Container | Case | Incident | Case | Record | Case | Incident | Security incident (SIR) |
| context-path | Context path (${...}) | Datapath | Formula (<<path.to.value>>) | Expression (@{body('step')}) | Placeholder ([Entity.Identifier]) | Reference ($record.field) | Expression ({{ .event.field }}) | Rule/script object (incident.properties) | Data pill |
| task | Work Plan task | Task (workbook phase) | Case task | Incident task | Task | Task | Case task | Task (within phase) | Response task |
| note | War Room entry | Note | Case note | Comment | Case wall comment | Comment | Case comment | Note | Work note |
Rewards driving fields from context rather than typing values — the thing that makes a playbook survive its second incident.
Cortex XSOARPalo Alto Networks
Layout fields bind to context paths; hard-coding a value in a task input is the classic reason a playbook only works on the incident it was written for.
Microsoft Sentinel + Logic AppsMicrosoft
Entities on the incident are the equivalent addressable objects; pull them from the incident trigger body rather than retyping.
Google SecOps SOARGoogle Cloud
Placeholders like [Entity.Identifier] resolve per alert, so the same playbook block works across the case.
Swimlane TurbineSwimlane
Reference record fields ($record.field) so the same playbook serves every application record.
Swap 'incident' for 'container' or 'story' and the discipline is unchanged: one object, paths not literals, decisions recorded where they happened.
CYBRARY