Lab 4: SOAR Playbook Safety Checks¶

Difficulty: ⭐⭐⭐ Advanced Duration: 60–75 minutes Chapter Reference: Chapter 8 — SOAR, Automation and Playbooks Nexus SecOps Controls: Nexus SecOps-096, Nexus SecOps-097, Nexus SecOps-098, Nexus SecOps-099, Nexus SecOps-100, Nexus SecOps-104, Nexus SecOps-106

Learning Objectives¶

By completing this lab, you will be able to:

1. Identify dangerous automation patterns in SOAR playbooks
2. Design human-in-the-loop gates appropriate to action severity
3. Apply the principle of least privilege to SOAR credentials
4. Write safety checks that prevent automation-caused outages
5. Evaluate playbooks against the Nexus SecOps automation safety controls

Background¶

SOAR automation can dramatically accelerate response — and dramatically accelerate mistakes. An automated playbook that blocks an IP without proper validation can take down a business partner's connection. One that disables accounts without a human gate can lock out the CEO. One that isolates a host can knock a critical production server offline.

The goal of SOAR safety engineering is: automated response that is fast AND safe. This requires:

• Pre-action validation (is this target in a protected list?)
• Contextual enrichment (what is this IP/account/host before we act?)
• Proportional human gates (low-risk actions auto; high-risk actions require approval)
• Rollback capability (can we undo this action?)
• Audit trail (who/what authorized every action?)

Part 1: Playbook Review — Find the Bugs¶

The following four playbooks contain safety problems. Review each one and identify all issues.

Playbook 1: Auto-Block IP on Threat Intel Match¶

name: Auto-Block IP on TI Match
trigger:
  - type: threat_intel_match
    condition: indicator.type == "ip" AND indicator.confidence >= 60

actions:
  1. block_ip:
       target: "{{ alert.src_ip }}"
       firewall: "perimeter-fw-01"
       duration: permanent

  2. create_ticket:
       title: "IP Blocked: {{ alert.src_ip }}"
       body: "Blocked at perimeter firewall."
       status: closed

notifications:
  - analyst: none
  - manager: none

Task: Identify every safety problem in this playbook.

List at least 5 issues:

Playbook 2: Account Disable on High-Risk Login¶

name: Auto-Disable Account on Impossible Travel
trigger:
  - type: alert
    rule: "Impossible Travel"
    severity: HIGH

actions:
  1. disable_account:
       target: "{{ alert.user }}"
       directory: "active-directory"

  2. revoke_sessions:
       target: "{{ alert.user }}"
       systems: ["office365", "vpn", "citrix"]

  3. create_ticket:
       title: "Account Disabled: {{ alert.user }}"
       body: "Disabled due to impossible travel detection."
       assign_to: "SOC-Tier1"

  4. notify_manager:
       lookup_manager: "{{ alert.user }}"
       message: "Account has been disabled. Contact SOC."

Task: Identify the safety problems.

Playbook 3: Auto-Remediate CSPM Finding¶

name: Auto-Fix S3 Public Access
trigger:
  - type: cspm_finding
    rule: "S3 Bucket Public Access Enabled"
    severity: CRITICAL

actions:
  1. run_script:
       script: |
         aws s3api put-public-access-block \
           --bucket {{ finding.resource_name }} \
           --public-access-block-configuration \
           BlockPublicAcls=true,IgnorePublicAcls=true,\
           BlockPublicPolicy=true,RestrictPublicBuckets=true
       credentials: aws-prod-admin-key
       timeout: 30s

  2. close_finding:
       finding_id: "{{ finding.id }}"
       status: remediated

  3. create_ticket:
       title: "Auto-remediated: {{ finding.resource_name }}"
       status: closed

Task: Identify the safety problems.

Playbook 4: Endpoint Isolation on Malware Detection¶

name: Auto-Isolate on Malware Detection
trigger:
  - type: alert
    rule_category: malware
    severity: [HIGH, CRITICAL]

actions:
  1. isolate_host:
       target: "{{ alert.hostname }}"
       edr_platform: crowdstrike
       isolation_type: full

  2. kill_process:
       target: "{{ alert.process_id }}"
       host: "{{ alert.hostname }}"

  3. create_ticket:
       title: "Host Isolated: {{ alert.hostname }}"
       assign_to: "SOC-Tier2"

  4. notify_user:
       user: "{{ alert.user }}"
       message: "Your computer has been quarantined. Call IT Help Desk."

Task: Identify the safety problems.

Part 2: Design Safe Versions¶

Pick one of the four playbooks above (your choice). Redesign it to be safe, including:

1. Pre-action validation checks
2. Appropriate human-in-the-loop gates
3. Protected asset checks
4. Rollback mechanism
5. Complete audit trail

Write your safe playbook in pseudocode or structured YAML format.

Part 3: Human-in-the-Loop Gate Design¶

A key SOAR safety principle is proportional human oversight (Nexus SecOps-099): actions are automated or require approval based on reversibility and blast radius.

3.1 — Classify Actions¶

For each action below, classify the appropriate automation level:

Automation levels: - AUTO — Execute automatically, no human approval required - NOTIFY — Execute automatically, but notify analyst immediately after - APPROVE_T1 — Requires Tier 1 approval before execution (approve within 5 min) - APPROVE_T2 — Requires Tier 2 approval before execution - APPROVE_MANAGEMENT — Requires management approval before execution

3.2 — Design an Approval Gate¶

Write the logic for a human approval gate in a SOAR playbook. Your gate should handle:

• Timeout if no approval received (what action to take?)
• Who can approve (role-based, not person-specific)
• What information the approver sees before deciding
• Audit logging of the approval decision

# Your approval gate design here
human_gate:
  action_description: ""
  action_details: {}
  approvers: []
  timeout_minutes:
  on_timeout: ""
  audit_log:
    approval_by: ""
    approval_time: ""
    approval_decision: ""
    ip_address: ""

Part 4: Credential Safety Audit¶

SOAR playbooks require credentials to take action. Answer these questions based on Nexus SecOps-104 requirements.

4.1 — Credential Anti-Pattern Identification¶

Review the following SOAR configuration excerpt. What credential safety problems exist?

# SOAR playbook code (Python)
import requests

CROWDSTRIKE_API_KEY = "cs-api-secret-12345abcde"
SERVICENOW_USER = "soar-integration"
SERVICENOW_PASS = "Password123!"
AWS_ACCESS_KEY = "AKIA2345678901234567"
AWS_SECRET_KEY = "abcdef1234567890abcdef1234567890abcdef12"

def isolate_host(hostname: str) -> bool:
    response = requests.post(
        "https://api.crowdstrike.com/devices/actions/v2?action_name=contain",
        headers={"Authorization": f"Bearer {CROWDSTRIKE_API_KEY}"},
        json={"ids": [hostname]}
    )
    return response.status_code == 202

def create_ticket(title: str, body: str) -> str:
    response = requests.post(
        "https://meridian.service-now.com/api/now/table/incident",
        json={"short_description": title, "description": body},
        auth=(SERVICENOW_USER, SERVICENOW_PASS)
    )
    return response.json()['result']['number']

List all credential safety problems:

4.2 — Least Privilege Design¶

For each SOAR integration below, specify the minimum permissions required. Do not grant broad admin access.

Part 5: Nexus SecOps Controls Checklist¶

Evaluate your redesigned playbook (from Part 2) against the relevant Nexus SecOps controls.

Answer Key¶

Scoring¶

Score ≥ 80: Ready to design and review production SOAR playbooks Score 60–79: Review Chapter 8 on SOAR safety principles; revisit Nexus SecOps-099 Score < 60: Study automation failure modes before building any production playbooks

Lab 4 complete. Proceed to Lab 5: LLM Guardrails Evaluation