Case management and SOAR: TheHive, Cortex, Shuffle
You send alerts into a case management system, automate enrichment and turn repetitive response steps into approved automation workflows.
Level 401 · 13 lessons · 12 practice labs
Lessons
Case management
- The case model: alert, case, task, observable
- Bringing SIEM alerts into cases
- Case templates and task lists
- Short task: open a templated case from a phishing alert
Enrichment
- Analysers: IP, domain and file reputation
- Responders: blocking and notification
- Keys and secrets in automation
- Short task: enrich all observables with one click
SOAR
- Designing a workflow: trigger, steps, decisions
- Steps that need human approval
- Automating phishing response
- When automation breaks: error handling and monitoring
- Capstone: build a semi-automated response line from alert to closure
Practice labs
- Open a case from an alert and add the observables: Create a case from a phishing alert and add the sender address, link and attachment hash as observables of the right type.
- Prepare a case template with a task list for phishing: Build a template with severity, tags and six tasks, then turn a new alert into a case with it and show the tasks appear.
- Bring SIEM alerts into case management with field mapping: Set up an integration that maps SIEM alert fields to case title, severity and observables, and stop the same alert opening two cases.
- Run an analyser on an observable and read its report: Run a reputation analyser on an address and copy the report’s summary verdict into the case note.
- Enrich every observable with one click: Map suitable analysers to address, domain and hash types, run them in bulk on all observables in a case and tag the malicious ones.
- Connect a blocking responder safely: Set up a responder that adds a bad domain to the lab DNS blocklist, read its key from the secret store and test the guard that refuses to block internal domains.
- Read and run the steps of a ready-made workflow: Identify the trigger, the three steps and the decision point of a workflow, run it with a sample alert and follow each step’s output.
- Build a workflow from alert to case to enrichment: Design a workflow triggered by webhook that opens a case, enriches observables and sets severity from the result.
- Automate phishing response with a human approval step: In a workflow starting from a user report automate the analysis, put purging the message behind analyst approval and show how the flow ends when approval is refused.
- Find the hard-coded key in a workflow and move it to a variable: Find an API key written in clear in a workflow step, move it to the workflow’s secret variable and show the workflow still runs.
- Add retries and failure notification for a failing step: Add retries and a final analyst notification to an enrichment step that times out, then trigger the failure deliberately to test it.
- Build monitoring that notices automation that stopped silently: Set up a health check that tracks the workflow’s last successful run and alerts processed, then break the trigger and show the alarm arrives.
About this course
You send alerts into a case management system, automate enrichment and turn repetitive response steps into approved automation workflows.
What you will learn
- Case management
- Enrichment
- SOAR
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.