CYBRARY Unit 4 — Working a breach without breaking the plant
12 minWorking the queue and closing the case
Filing alerts to a zone and a response, watching the breach timeline resolve, and what the closed case must hold.
By the end you can
- Work an alert queue that contains routine plant noise.
- Explain how the timeline resolves as detections are accounted for.
- List what a closed case must record for an assessment to use it.
The queue is not all breach
A real plant queue carries routine behavior alongside the intrusion — a poll gap, a replica catching up, a maintenance login, an analyzer restarting. Closing those correctly is part of the skill; closing a real detection as noise is the failure the lab will not forgive.
What the closed case holds
The case is the evidence artifact. It names the asset by zone and level, the conduit that was crossed and the rule that should have stopped it, the safe response taken and why the alternative was rejected, and the operations decision with its timestamp.
- The asset, by Purdue level and zone.
- The conduit crossed, and the control that should have held.
- The response taken, and why isolating the controller was not it.
- The operations decision, who made it and when.