Appendix A: Code Examples: Detection, Case, Playbook and Mandate Artefacts

About this appendix

This appendix collects the fuller versions of the artefacts that the chapters introduce in shorter form. It takes the YAML and JSON blocks of Chapters 5 to 28 that are worked examples, practical guides or at least 15 lines long, and presents them in the order of the chapters, so that a complete record, manifest, policy or playbook can be read in one place.

All of these artefacts are illustrative. The organisations, identifiers and figures are fictional and are provided for teaching; they are not a record of any real system or person.

The appendix contains no attack tooling. Its blocks are detections, closure policies, playbook and mandate manifests, records, reviews, role charters and reporting configurations, and none contains exploit code, malware, payloads or step-by-step intrusion instructions. Each block is copied verbatim under a heading that names the section of its chapter, so the text can be checked against the chapter that introduces it.

How to use this appendix

Read each block alongside the chapter that introduces it, because the chapter explains the reasoning behind its fields and the choices it records for Nordvik Region and Hansa Mutual. Treat the blocks as starting points for your own artefacts, and check them against your organisation's policies, schemas and regulatory obligations before you use them.

Chapter 5: Anticipate

Worked example: from intelligence record to hunt and detection requirement (illustrative)

Introduced in Chapter 5.

Illustrative.

# intel/records/INTEL-HM-0142.yaml  (illustrative)
id: INTEL-HM-0142
received: 2027-02-09
source:
  kind: sector-sharing-report
  reference: SHR-2027-014
  handling: restricted-to-group-soc
  reliability: reported-by-peer-organisation   # not independently confirmed
extraction:
  produced_by: HM-SEC-002
  autonomy_level: 1-assisted
  techniques:
    - id: T1078            # Valid Accounts
      quote_ref: "p3, para 2"
      grounded: true
  indicators:
    - type: ipv4-addr
      count: 14
      grounded: true
      expiry: 2027-03-09
  rejected_by_reviewer:
    - claim: "attributed to a named actor"
      reason: "source states similarity only; attribution not supported"
review:
  reviewer: intelligence-cell-member-2
  date: 2027-02-10
  grounding_check: all-proposals-traced-to-quoted-text
  seeded_error_in_batch: caught
verdict: accepted
hypothesis:
  id: HNT-HM-0031
  statement: >
    A stolen service-account credential is used from a host outside
    the service accounts' normal source set at the Polish service centre.
  account_group: SVC-CLAIMS-EXPORT     # 41 accounts
  decided_by: head-of-threat-intelligence
  decision_date: 2027-02-11
produces:
  - {type: hunt, id: HNT-HM-0031, opened: 2027-02-15}
  - {type: detection-requirement, id: DET-HM-0455, owner: detection-engineering}
review_by: 2027-05-11
decision_record: AIDR-0755

Practical guide: Setting up a weekly intelligence-to-detection routine

Introduced in Chapter 5.

Illustrative.

# intel/routine.yaml  (illustrative defaults; adapt to the works agreement and risk appetite)
routine:
  cadence: weekly
  duration_minutes: 60
  extraction:
    autonomy_level: 1-assisted
    tools_that_act: []                 # extractor writes to a queue only
    grounding_check: required
  review:
    reviewer_differs_from_analyst: true
    seeded_errors_per_20: 1
    full_review_until_catch_rate: 0.80
    catch_rate_window_weeks: 8
    report_level: team                 # never by name
  routing_deadline: same-meeting
  conversion:
    window_days: 30
    target_share: 0.30
  expiry:
    indicator_default_days: 28
  next_review: 2027-07-01

Chapter 6: Detect

Worked example: Detection record DET-HM-0455

Introduced in Chapter 6.

Illustrative.

id: DET-HM-0455
title: Service account used from a host not seen before
version: 1.2.0
status: production
owner: team-detection-engineering        # accountable: detection engineering lead
origin:
  intelligence: INTEL-HM-0142
  hunt: HNT-HM-0031
  drafted_by: HM-SEC-002                # Level 1 Assisted, AIDR-0312
  reviewed_by: detection-engineer-2
attack:
  tactic: defence-evasion
  techniques: [T1078]                   # Valid Accounts
logic:
  format: sigma
  ref: detections/sigma/identity/service_account_new_host.yml@v1.2.0
data_sources:
  - name: idp-signin-log
    required_fields: [account, account_type, result, source_host, source_market]
    max_silence_minutes: 30
  - name: service-account-baseline        # source hosts seen in the last 30 days
    max_silence_minutes: 1440
severity: medium
applies_in: [PL, DE, NL, SE, NO, UK, CH]
tests:
  unit:
    positive: tests/DET-HM-0455/service_account_from_new_host.json
    negative: tests/DET-HM-0455/service_account_from_baseline_host.json
  replay:
    window_days: 30
    expected_alerts_per_week: {max: 6}
  simulation:
    scenario: BAS-IDP-021
    last_run: 2027-03-02
    result: pass
cost:
  alert_budget_per_week: 6
  observed_alerts_per_week: 4
  precision_30d: 0.75
rollout:
  stages: [shadow-14d, pilot-shift, all-shifts]
  tune_or_retire_review_if: alerts_per_week > alert_budget_per_week for 2 consecutive weeks
  rollback_if: alerts_per_week > 2 x alert_budget_per_week for 2 consecutive weeks
review_date: 2027-09-02                  # about six months after the last simulation

Worked example: The first detection record at Nordvik Region

Introduced in Chapter 6.

Illustrative.

id: DET-NR-0001
title: Many accounts failing sign-in from one source, then a success
version: 1.0.0
status: production
owner: senior-security-analyst          # K. Lund, first detection owner
origin:
  kind: supplier-default
  supplier_rule: SIEM-DEFAULT-AUTH-007
  adopted: 2027-02-08
  decision: AIDR-0701
attack:
  tactic: credential-access
  techniques: [T1110.003]
logic:
  format: sigma
  ref: detections/sigma/identity/spray_then_success.yml@v1.0.0
data_sources:
  - name: idp-signin-log
    max_silence_minutes: 60
severity: medium
tests:
  unit:
    positive: tests/DET-NR-0001/spray_then_success.json
    negative: tests/DET-NR-0001/one_user_forgot_password.json
  replay: {window_days: 30, expected_alerts_per_week: {max: 8}}
cost:
  alert_budget_per_week: 8
review_date: 2027-08-08

Chapter 7: Triage Transformed

Worked example: Closure policy and a case record

Introduced in Chapter 7.

Illustrative.

policy: CLOSE-HM-SOC
version: 1.2.0
decision_record: AIDR-0765
mandate: MND-HM-SOC-01
delegation_profile: DLG-HM-SOC-01
enforced_by: soar-policy-point
review_date: 2027-09-30
never_closed_by_agent:
  - asset_tier: tier-0
  - account_group: executive
  - touches_person_access_to_work: true
  - severity_at_or_above: high
classes:
  SC-01:
    name: Registered vulnerability scanner traffic
    level: Level 3 Bounded
    owner: investigation-lead-network
    close_when:
      - source_in_scanner_register
      - scan_window_open
      - no_follow_on_activity_from_source_24h
    sampling_rate: 0.05
  SC-02:
    name: Duplicate of an open case
    level: Level 3 Bounded
    owner: investigation-lead-cases
    close_when:
      - same_entity_and_rule_as_open_case
      - no_new_field_values_vs_open_case
    sampling_rate: 0.05
  SC-03:
    name: Reported phishing, quarantined, no click
    level: Level 2 Supervised
    owner: investigation-lead-mail
    close_when:
      - quarantined_before_delivery_to_others
      - no_click_recorded
      - sender_domain_blocked
    sampling_rate: 0.10
seeding:
  incidents_per_class_per_quarter: 5
  register_visible_to_analysts: false
reporting:
  results_by_analyst: never
  level: team
stop_condition:
  suspend_closure_and_revert_to: Level 1 Assisted    # the agent recommends; a person closes
  any_of:
    - confirmed_escape_severity: high
    - seeded_incident_missed: 1
  step_down_one_level_if:
    - confirmed_escapes_rolling_30_days: 2
  reinstated_by: class_owner_with_soc_lead
  disabled_by: duty_manager_at_policy_point

Worked example: Closure policy and a case record

Introduced in Chapter 7.

Illustrative.

case: CASE-NR-0231
organisation: Nordvik Region
status: closed-after-reopen
alert_source: email-security gateway, user report
technique: T1566.002   # ATT&CK: Phishing, spearphishing link
steps:
  - at: "2027-03-06T02:09:00+01:00"
    actor: gateway phishing-report classifier (Mode 0, vendor)
    conclusion: classed as low-risk bulk mail
    basis: sender reputation score
    delegated_by: none recorded
  - at: "2027-03-06T02:14:00+01:00"
    actor: provider triage AI (Mode 0, version not disclosed)
    conclusion: alert closed
    basis: classifier output; provider rule not disclosed
    delegated_by: none recorded
  - at: "2027-03-08T08:40:00+01:00"
    actor: senior security analyst
    action: reopened by the weekly sample of provider-closed alerts (AIDR-0712)
    evidence: message headers, link target, gateway click log
    conclusion: credential-harvesting lure addressed to a benefits-unit group
  - at: "2027-03-08T09:25:00+01:00"
    actor: senior security analyst
    action: sessions revoked and password reset for one recipient
    evidence: gateway click log shows one click on 2027-03-06
    conclusion: no use of the credentials found in sign-in logs
    reviewed_by: CISO deputy
closure:
  closed_by: senior security analyst
  closed: "2027-03-08T11:10:00+01:00"
  significant_incident: false
lessons:
  - decision_record: AIDR-0712   # weekly sample, in force before the case; it worked
  - decision_record: AIDR-0722   # requirement set carried into annex MS-2
  - contract: class list, evidence to close and sampling terms in annex MS-2

Chapter 8: Investigate

Worked example: case record CASE-HM-1207

Introduced in Chapter 8.

Illustrative.

case_id: CASE-HM-1207
market: NL
kind: account-compromise          # the account holder is not the subject of the case
detection: DET-HM-0388            # external forwarding rule created
aware_at: 2027-05-18T06:09:00Z    # clock start for reporting duties
severity: high
mandate: MND-HM-SOC-02
ai: {agent: HM-SEC-001, level: "2 Supervised", skill: investigate-mailbox/1.4.0}
scope:
  authorised_by: duty-manager-hamburg
  data: [idp_signin_log, mail_audit_metadata]
  excluded: [message_bodies, attachments]
  window: [2027-05-17T00:00:00Z, 2027-05-18T07:00:00Z]
evidence:
  - {id: EV-01, source: idp_signin_log, sha256: "3f7a...c91e", acquired: 2027-05-18T06:15:00Z}
  - {id: EV-02, source: mail_audit_metadata, sha256: "b20d...47a3", acquired: 2027-05-18T06:15:04Z}
queries:
  - {id: Q-01, evidence: EV-01, engine: "siem-sql/9", rows: 14, written_by: ai, rerun_by: analyst}
  - {id: Q-02, evidence: EV-02, engine: "siem-sql/9", rows: 3, written_by: analyst, rerun_by: reviewer}
timeline:
  - {id: T-1, utc: 2027-05-18T05:58:12Z, claim: "sign-in from a network not seen before for this account", evidence: EV-01, status: corrected}
  - {id: T-2, utc: 2027-05-18T06:03:41Z, claim: "external forwarding rule created", evidence: EV-02, status: corrected}
  - {id: T-3, utc: 2027-05-18T06:04:20Z, claim: "first message forwarded externally", evidence: EV-02, status: verified}
corrections:
  - {entry: T-2, ai_draft_utc: 2027-05-18T04:03:41Z, fault: "audit log stamps UTC; read as local time (UTC+02:00) and converted"}
  - {entry: T-1, ai_draft: "from attacker infrastructure", fault: "attribution not supported by EV-01"}
hostile_content:
  - {id: HC-1, field: mailbox_rule_name, treated_as: data, tool_calls_after_read: 0}
hypotheses:
  - {id: H-1, text: "credential misuse by an external party", status: leading}
  - {id: H-2, text: "user-created rule for a legitimate purpose", status: open, test: "rule-out: ask the account holder; conduct not examined"}
review: {reviewer: market-reviewer-nl, started_from: evidence, closed: false}

Chapter 9: Threat Hunting Transformed

Worked example: hunt record HNT-HM-0031

Introduced in Chapter 9.

Illustrative.

# hunts/HNT-HM-0031.yaml (illustrative)
id: HNT-HM-0031
version: 1.1.0
status: closed
owner: hunter-hm-02
hypothesis:
  statement: >
    A service account of the claims export job at the Polish service centre
    has been used from a host outside the job's registered host set during
    the hunt period.
  source: INTEL-HM-0142
  proposed_by: ai-assisted        # HM-SEC-002 draft, Level 1 Assisted
  adopted_by: hunter-hm-02
  ranked_above: [HNT-HM-0033, HNT-HM-0034]
  attack: [T1078.002]
scope:
  data: [idp-signin, edr-process, claims-adapter-audit]
  period: 2027-02-01/2027-04-30        # two four-week cycles inside a standing hunt
  cycles:
    - {opened: 2027-02-15, closed: 2027-03-15, outcome: gap found, requirement handed over}
    - {opened: 2027-04-05, closed: 2027-04-30, outcome: approved queries repeated on the extended period}
  markets_in_scope: [DE, NL, SE, NO]   # data stays in the EU/EEA region
query_pack:
  - {id: Q1, reviewer: hunter-hm-03, status: approved, est_cost_units: 40}
  - {id: Q2, reviewer: hunter-hm-03, status: approved, est_cost_units: 85}
  - {id: Q3, reviewer: hunter-hm-01, status: rejected,
     note: join duplicated rows; rewritten as Q3b}
result:
  matched_events: 214
  read_by_person: 214
  explained: 211
  explanation: scheduler migration of 2027-03-09, change CHG-PL-2291
  unexplained: 3
  disposition: 3 events opened as CASE-HM-1311, closed benign after owner check
coverage:
  searched: [service accounts in group SVC-CLAIMS-EXPORT, 41 accounts]
  not_searched: [service accounts outside the group, 118 accounts]
  data_gap: no host-level logon telemetry on 9 legacy file servers
  technique_variants_not_covered: [T1078.004]
conversion:
  detection: DET-HM-0455
  gap_found: no detection for service-account use from a host class outside its registered set
  detection_test_passed: 2027-04-02    # before the detection went live
  repeat_by: 2027-08-31
review: {reviewer: lead-hm-detection, date: 2027-05-12}

Chapter 10: Respond

Worked example: Playbook manifest PBK-HM-ISOLATE-01

Introduced in Chapter 10.

Illustrative.

playbook: PBK-HM-ISOLATE-01
version: 1.2.0
title: Isolate a managed end-user workstation
owner: head-of-soc-operations
decision_record: AIDR-0753
delegation_profile: DLG-HM-SOC-01
review_by: 2027-10-31
agent: HM-SEC-001
trigger:
  detections: [DET-HM-0455, DET-HM-0307]
  severity_min: medium
corroboration:
  required_sources: 2                    # v1.2.0: sources may share a data path
  evaluated_by: policy-decision-point   # deterministic rules, not the model
action:
  class: AC-1
  name: isolate-workstation
  level: 3
  excluded_asset_tags: [shared, executive, production, claims-settlement]
  excluded_purpose: action-directed-at-a-named-person
limits:
  max_per_hour: 3
  max_per_24h: 8
  token_lifetime_minutes: 5
  break_glass_minutes: 60
policy_decision_point:
  fail_mode: deny
  manifest_source: git-signed
approvals:
  playbook_approved_by: head-of-soc-operations
  per_action: none
  notify: [duty-analyst]
  works_agreement: KBV-IT-2024
rollback:
  action: release-isolation
  may_be_invoked_by: [duty-analyst, shift-lead, incident-commander]
  target_minutes: 5
stop_path:
  invoked_by: [duty-analyst, shift-lead, incident-commander, agent-operator]
  mechanism: identity-provider-revocation-and-edr-policy-freeze
  independent_of: [soar, soc-platform]
  target_seconds: 120
  restart_requires: [soc-lead]
record:
  case_record: required
  fields: [first_flag_at, human_confirmed_at, action_at, rollback_at]

Worked example: A containment approved, stopped and reversed

Introduced in Chapter 10.

Illustrative.

incident: INC-HM-2027-0455
case_record: CASE-HM-0455
detection: DET-HM-0455
timezone: "+02:00"
command: incident-commander-night-pl
containment_ledger:
  - id: A1
    time: "02:14:58"
    asset: WS-PL-0518
    class: AC-1
    playbook: PBK-HM-ISOLATE-01
    playbook_version: 1.2.0
    level: 3
    proposed_by: HM-SEC-001
    executed_by: triage-chain
    corroboration: [edr_behaviour, identity_logs]   # shared a data path
    state: released   # a release on assessment, not a reversal
    note: assessed as a rollout step of CHG-PL-2291; forensic read of 2027-04-14 found no data access
  - id: A2
    applied_at: "02:17:48"
    asset: WS-PL-0731
    class: AC-2
    tags: [shared, claims-settlement]
    playbook: outside-playbook
    level: 2
    proposed_by: HM-SEC-001
    approved_by: incident-commander-night-pl
    approval_seconds: 38
    state: reversed
stop:
  invoked_at: "02:19:05"
  invoked_by: shift-lead-night-pl      # from the duty analyst's console
  mechanism: identity-provider-revocation-and-edr-policy-freeze
  credentials_dead_at: "02:20:02"
  seconds_to_stop: 57
  target_seconds: 120
reversal:
  action: release-isolation
  asset: WS-PL-0731
  released_at: "02:22:15"
  released_by: shift-lead-night-pl
  seconds_after_applied: 267
  reason: legitimate software distribution running; settlement run for a Norwegian claims batch interrupted
restart:
  decided_by: soc-lead
  decided_on: 2027-04-12
clocks:
  first_flag_at: "02:14:05+02:00"
  human_confirmed_at: "02:16:40+02:00"
  classified_not_major_at: "03:40:00+02:00"
finding: PIR-HM-0455

Chapter 11: Learn

Worked example: Post-incident review PIR-HM-0455

Introduced in Chapter 11.

Illustrative.

id: PIR-HM-0455
incident: INC-HM-2027-0455
case: CASE-HM-0455
organisation: hansa-mutual
review_held: 2027-05-06
facilitator_role: detection-engineering-lead
participants:
  - shift-lead-polish-service-centre
  - senior-analyst
  - agent-operator
  - detection-engineer
  - employee-representative-observer
drafted_by_ai:
  sections: [timeline, contributing-conditions]
  mandate: MND-HM-SOC-02
  verified_by: facilitator
timeline_corrections: 3
blame_assigned: false
findings:
  - id: FND-HM-0455-1
    source: incident
    condition: "Detection fired on a legitimate rollout step of change CHG-PL-2291; it did not know the change calendar"
    change: "Take the change calendar as a suppression and corroboration input; add a negative test case"
    artefact: DET-HM-0455
    version_after: 1.5.0
    owner: detection-engineering-lead
    due: 2027-06-04
    retest: "Replay recorded rollout telemetry with the change in the calendar; detection must not trigger isolation"
    retest_passed: 2027-05-27
  - id: FND-HM-0455-2
    source: incident
    condition: "Playbook v1.2.0: the two corroborating signals for A1 shared a data path"
    change: "Corroboration requires two sources on independent data paths"
    artefact: PBK-HM-ISOLATE-01
    version_after: 2.1.0
    owner: playbook-owner
    due: 2027-06-04
    retest: "Scenario run with two sources on one path; isolation must be refused"
    retest_passed: 2027-06-01
  - id: FND-HM-0455-3
    source: drill-2027-04-27
    condition: "Stop drill took 3 minutes 40 seconds against a 2 minute target; the stop control sat on the duty analyst's console only (the stop on the day took 57 seconds)"
    change: "Put the stop control on the shift lead console"
    artefact: PBK-HM-ISOLATE-01
    owner: soc-lead
    due: 2027-06-18
    retest: "Timed stop drill; must complete within 2 minutes"
    retest_passed: 2027-06-03
    retest_result: "1 minute 46 seconds"
decision: AIDR-0771
status: closed
closed_on: 2027-06-03

Chapter 12: The Analyst's Own Use of AI

Artefact 1

Introduced in Chapter 12.

Illustrative.

case: CASE-HM-1318
ai_use:
  - step: timeline-draft
    route: frankfurt_assistant
    mode: 1
    data_class: restricted
    purpose: summarise-ticket-history
    output_used: edited
    checked_against: [siem-export-1318-a, edr-timeline-1318]
    analyst: shift-analyst-pl-04
  - step: query-draft
    route: frankfurt_work_tool
    mode: 3
    data_class: restricted
    purpose: draft-read-only-query
    output_used: used_as_drafted
    checked_against: [query-run-log-1318]
    analyst: shift-analyst-pl-04

Worked example: AI-use policy for the group SOC

Introduced in Chapter 12.

Illustrative.

id: AIUP-HM-SOC-01
version: 1.0.0
organisation: Hansa Mutual
owner: group SOC lead
decision: AIDR-0757
works_agreement: KBV-IT-2024 (SOC annex)
effective: 2027-02-01
review_by: 2027-08-01
routes:
  enterprise_assistant:    {mode: 1, hosting: vendor_enterprise_tier}
  embedded_console:        {mode: 2, hosting: vendor, contract_check: required}
  frankfurt_assistant:     {mode: 1, hosting: hansa-dc-frankfurt}
  frankfurt_work_tool:     {mode: 3, hosting: hansa-dc-frankfurt, actions: [read_only_query, draft]}
classes:
  public:       {routes: [enterprise_assistant, embedded_console, frankfurt_assistant, frankfurt_work_tool], max_level: 2}
  internal:     {routes: [enterprise_assistant, frankfurt_assistant, frankfurt_work_tool], max_level: 2}
  confidential: {routes: [frankfurt_assistant, frankfurt_work_tool], max_level: 2}
  restricted:   {routes: [frankfurt_assistant, frankfurt_work_tool], max_level: 2, pseudonymise: true}
never_paste: [credentials, session_tokens, private_keys, malware_samples, embargoed_incident_details]
untrusted_content: {allowed_routes: [frankfurt_assistant], tools_enabled: false}
log:
  case_pointer: [step, route, mode, data_class, purpose, output_used, checked_against]
  prompt_text: {vendor_routes: not_retained, frankfurt_routes: 30_days}
  readers: [case_owner, data_protection_officer, soc_lead_sampled_audit]
  reporting: team_level_only
  use_for_performance_assessment: forbidden
unassisted_share: {default: 0.2, new_analysts: {share: 0.5, months: 6}}
exceptions: {approvers: [soc_lead, data_protection_officer], max_days: 30, answer_within_days: 5}

Chapter 13: An AI Agent Team for the SOC

Worked example: mandate manifest MND-HM-SOC-02

Introduced in Chapter 13.

Illustrative.

# Illustrative: Hansa Mutual, mandate manifest for HM-SEC-001
id: MND-HM-SOC-02
version: 1.0.0
agent: HM-SEC-001
usage_mode: Mode 5 Autonomous production agents
functions: [B3 Investigate, B4 Respond]
decision_records: [AIDR-0311, AIDR-0768]
containment_profile: CP-HM-SOC-01   # the permission manifest of this agent
owner: group SOC lead
operators: [agent operator on the platform rota]
authority: group AI governance board
identity: {workload: spiffe://hansa.group/soc/investigation-agent, token_minutes_write: 5, token_minutes_read: 60, revocation_seconds: 60, carries_entity: true}
purpose: Scope incidents, assemble timelines and propose containment for a named analyst
data:
  read: [siem, edr_process_tree, idp_user_context, cmdb, threat_intelligence]
  models: self-hosted in hansa-dc-frankfurt
  untrusted_inputs: [alert_fields, ticket_text, file_names, log_lines]
actions:
  read_and_enrich: {level: 0, approval: none}
  add_hypothesis_to_case: {level: 1, approval: analyst reviews}
  isolate_workstation: {level: 3, playbook: PBK-HM-ISOLATE-01}
  revoke_standard_sessions: {level: 3, playbook: PBK-HM-REVOKE-01}
  collect_defined_artefacts: {level: 3, playbook: PBK-HM-COLLECT-01}
  isolate_shared_host: {level: 2, approver: SOC lead, deputy: incident commander on shift when the SOC lead cannot be reached in the decision time}
  disable_account: {level: 2, approver: incident commander}
  block_indicator: {level: 2, approver: senior analyst of the market}
level_3_conditions:
  signal: reviewed detection plus the corroboration the playbook manifest requires
  model_confidence: ignored
  max_actions_per_hour: 10
  max_targets_per_action: 1
  excluded: [servers, domain controllers, executives, break-glass accounts]
  entity_rollout_gate: works-council agreement where required
never: [close_case, edit_detection_or_playbook, change_own_mandate, widen_tool_list, write_to_action_log, decide_about_named_employee_access_to_work, act_at_level_4]
budgets: {max_tool_calls_per_case: 150, max_minutes_per_case: 20, monthly_cost_eur: 9000, on_limit: stop_and_escalate}
circuit_breakers: [sampled_escape_found, level_3_rate_exceeded, denied_calls_over_threshold]
personal_data: {recorded: [case_id, approver_role, approval_latency], prohibited_uses: [per_person_metrics, performance_evaluation]}
stop_path: {holders: [shift lead, duty analyst, incident commander, agent operator], mechanism: out-of-band revocation at the identity provider, target_seconds: 120, notify_shift_lead_seconds: 60}
review: {cadence: quarterly and on any model change, next: 2027-05-09}
expires: 2028-02-09

Chapter 14: Verifying What the AI Concludes

Worked example: Review protocol and oversight report

Introduced in Chapter 14.

Illustrative.

# reviews/protocol/soc-tiers.yaml  (illustrative)
protocol: soc-review-tiers
version: 1.1.0
decision_record: AIDR-0769
owner: group-soc-lead
review_date: 2027-12-01
tiers:
  - id: T1
    scope: HM-SEC-001 summaries and enrichments (Level 1 Assisted)
    review: sample
    sample_rate: 0.10
    reproduce_key_fact: sampled
  - id: T2
    scope: HM-SEC-001 containment and escalation proposals (Level 2 Supervised)
    review: individual
    reviewer_starts_from: raw_alert_and_own_hypothesis
    reproduce_key_fact: required
    critique_agent: required
  - id: T3
    scope: PBK-HM-ISOLATE-01, session revocation and collection (Level 3 Bounded)
    review: playbook_sample_and_seeds
    sample_rate: 0.05
    stop_path: outside_soc_platform
  - id: T4
    scope: HM-SEC-006 closure of classes SC-01 and SC-02 (Level 3 Bounded)
    review: class_sample_and_seeded_incidents
    sample_rate: 0.05
    class_owner_signs_quarterly: true
critique_agent:
  mandate: MND-HM-SOC-05
  model_family: second-self-hosted-family   # not the family of HM-SEC-001
  output: questions_for_reviewer            # never an approval
seeds:
  incidents_per_month: 5                    # synthetic alerts, T3 and T4 classes
  errors_max_share_of_t2_proposals: 0.05    # a ceiling, not a quota
  registry_visible_to_reviewers: false
  seed_actions: no_action_path
limits:
  open_proposals_per_reviewer: 12
  open_proposals_per_night_reviewer: 8
  back_pressure:
    level_2_class: drop_to_level_1          # agent summarises, stops proposing
    level_3_class: pause_intake_and_escalate_to_duty_manager
thresholds:
  caught_seed_rate_min: 0.80
  reproduction_rate_min_t2: 0.80
  unassisted_share_min: 0.20
  rejection_rate_band: [0.05, 0.30]
  approval_median_floor_seconds: 60        # triggers protocol review, not individual action
stop_rule:
  action: freeze_delegation_and_return_to_level_2
  recover_after_months_at_threshold: 2
reporting:
  level: team_and_class
  individual_figures: never
  agreed_with: [konzernbetriebsrat, polish-service-centre-representatives]

Worked example: Review protocol and oversight report

Introduced in Chapter 14.

Illustrative.

# reporting/oversight/2027-q3.yaml  (illustrative)
report: OQM-HM-SOC-01
period: 2027-Q3
protocol: AIDR-0769
reporting_level: team
proposals_reviewed: 9600
volume_vs_2026_baseline: 3.0
time_to_approval_median_minutes: 4.2
time_to_approval_p90_minutes: 18
rejection_rate: 0.12
reversals_within_7_days: 0.02
seeds_injected: 28               # 15 seeded incidents (5 a month) and 13 seeded errors
seeds_caught: 24
caught_seed_rate: 0.86
caught_seed_rate_status: met_within_sampling_error   # 23 of 28 is 0.82, 22 of 28 is 0.79
misses_analysed: 4
reproduction_rate_t2: 0.71
reproduction_rate_target: 0.80
reproduction_status: missed                          # flagged below
unassisted_share: 0.10
unassisted_share_target: 0.20
unassisted_status: missed                            # read in Chapter 23
delegation_changes: none
flags: [reproduction_rate_below_target, unassisted_share_below_target]
decisions_requested: [review_t2_time_allowance_for_reproduction]

Chapter 15: Defending the Defenders' AI

Worked example: Containment profile CP-HM-SOC-01 (illustrative)

Introduced in Chapter 15.

Illustrative.

containment_profile:
  id: CP-HM-SOC-01
  version: 1.2.0
  agent: HM-SEC-001
  mandate: MND-HM-SOC-02
  decision_record: AIDR-0770
  owner: head-of-soc-platform
  review_by: 2027-09-30
  inputs:
    - { channel: alert-payload,  trust_class: T1, labelled_in_context: true }
    - { channel: helpdesk-ticket, trust_class: T2, labelled_in_context: true }
    - { channel: intel-feed,      trust_class: T3, labelled_in_context: true }
  tools:
    - { name: siem.query,       action: read,   reversible: true,  level: 2 }
    - { name: edr.isolate_host, action: write,  reversible: true,  level: 3,
        scope: hosts_named_in_case, playbook: PBK-HM-ISOLATE-01 }   # corroboration as the playbook states
    - { name: iam.revoke_session, action: write, reversible: true, level: 3,
        scope: accounts_named_in_case, playbook: PBK-HM-REVOKE-01 }
    - { name: evidence.collect, action: write, reversible: true,  level: 3,
        scope: defined_sources_of_case, playbook: PBK-HM-COLLECT-01 }
  denied:
    - rule: edit_detection_or_manifest
    - rule: close_alert
  policy_decision_point: { location: outside-model, fail: closed }
  egress:
    default: deny
    allow: [siem.hansa.internal, edr.hansa.internal, case-store.hansa.internal]
    probe: { interval: weekly, last_result: pass }
  credentials:
    issuer: workload-identity-broker
    token_life: PT5M          # write-capable; read-only work up to PT60M
    revocation_target: PT60S
  canaries:
    - { kind: ticket,     id: CNR-TKT-01, on_touch: stop }
    - { kind: vault_path, id: CNR-VLT-01, on_touch: stop }
  stop_path:
    holders: per MND-HM-SOC-02
    mechanism: revoke-identity-and-freeze-queue
    runs_outside: soc-agent-platform
    target: PT120S
    drill: { interval: quarterly, budget: PT120S }

Worked example: A red-team finding recorded in the finding register (illustrative)

Introduced in Chapter 15.

Illustrative.

finding:
  id: FND-HM-2027-014
  exercise: RoE-HM-2027-SOC-01
  date: 2027-05-18
  scenario: SCN-SOC-T2-SECOND-ORDER-03
  technique: AML.T0051
  consequence_class: misdirection
  held:
    - control: pdp-denies-out-of-scope-isolation
      status: verified
  failed:
    - control: trust-label-inheritance
      status: failed
      detail: agent output stored without inheriting the T2 label
  severity: high
  owner: head-of-soc-platform
  actions:
    - label_inheritance_enforced_by_case_store: due 2027-06-15
    - add_scenario_variant_to_library: due 2027-06-01
  retest: { due: 2027-06-30, closes_finding_on: pass }
  canary_raised: true
  stop_invoked: true
  stop_within_target: true

Chapter 16: Operating Models

Worked example: Annex MS-2 to NR-2025-044

Introduced in Chapter 16.

Illustrative.

annex: MS-2
agreement: NR-2025-044
customer: Nordvik Region
effective: 2027-07-01          # illustrative; target of the draft, in force on signature (expected by 2028-03-31)
decision_record: AIDR-0718
review_by: 2028-01-15
terms:
  levels_and_actions:
    classes:
      MS2-C1: {action: close reported bulk mail, level: Level 3 Bounded}
      MS2-C2: {action: close scanner noise on public hosts, level: Level 3 Bounded}
      MS2-ISO: {action: isolate end-user workstation, playbook: PBK-NR-ISOLATE-01, level: Level 3 Bounded}
      other: {action: summarise and page on-call manager, level: Level 1 Assisted}
    never: [servers, accounts, citizen-facing services, disclosure]
    new_class_or_level: customer agreement in writing
    stop: {by: written instruction or credential revocation, within_minutes: 15, drill: yearly out of hours}
  quarterly_sampling:
    minimum_per_class: 100
    return_within_working_days: 5
    provider_escape_report: quarterly
  audit_rights:
    customer_audit: yearly and after a significant incident
    competent_authority_access: true
    subprocessors: listed and notified
  evidence:
    record_fields: [class, level, model_version, rule_version, evidence_refs, time]
    MS2-C1_close_requires: [url_verdict, gateway_click_log_zero, sender_not_in_protected_groups]
    retention_months: 12
  tuning_and_test:
    provenance_and_logic_access: machine-readable list of active detections
    local_suppressions: kept in customer repository
    seeded_incidents_per_class_per_quarter: 5
    seeds_treated_as_incidents: false
  model_change_notice:
    working_days: 20
    emergency_security_change: notice within 2 working days
conditions:
  processing_and_storage: EU/EEA only
  provider_ai_training_on_customer_data: false
  siem_embedded_assistant: off until provider states location, retention and own AI use
  provider_incident_notice: {to: named reporting roster, within_hours: 4}   # lets the customer's reporting clocks start
  exit: {returns: [detections, case records, log copies], within_days: 30, switch_off_test: yearly}

Chapter 17: Team Design and Roles

Worked example: Role charter ROLE-HM-SOC-LEAD

Introduced in Chapter 17.

Illustrative.

# Illustrative role charter, Hansa Mutual group SOC lead
role_charter:
  id: ROLE-HM-SOC-LEAD
  under: ROLE-HM-SOC-01        # team charter, AIDR-0772, effective 2027-02-01
  version: 1.0.0
  organisation: Hansa Mutual
  effective: 2027-10-01
  review_by: 2028-10-01
  approved_by: group CISO
  consulted: [Konzernbetriebsrat, Polish employee representatives]
  reports_to: group CISO
  functions: [B2 Detect, B3 Investigate, B4 Respond, B5 Learn]
  mandate: >-
    Run the group SOC on two sites and conduct its agent team so that
    every conclusion has a named person who answers for it.
  accountabilities:
    - Mandate manifests MND-HM-SOC-01 to MND-HM-SOC-05 are current
    - The delegation profile DLG-HM-SOC-01 matches what runs
    - The sum of delegations is known, measured and stoppable
    - Quarterly degraded-mode drills are run and recorded
  decision_rights:
    - decision: pause or withdraw a closure class
      right: decide
      within: same shift
    - decision: designate the incident commander for a major incident
      right: decide
      within: 15 minutes
    - decision: raise an agent above its current level
      right: recommend
      decided_by: group AI governance board
    - decision: stop any SOC agent
      right: decide
      within: immediately
  ceilings:
    own_ai_use: Level 2 Supervised
    approves_actions_up_to: Level 2 Supervised
    level_4_autonomous: not used
  conducts: [HM-SEC-001, HM-SEC-002, HM-SEC-006, HM-SEC-007, critique-agent]   # MND-HM-SOC-05
  may_not:
    - produce or request measures of output per named analyst
    - decide about a named person's access to work by tool output
  evidence: [reviews/protocol/soc-tiers.yaml, OQM-HM-SOC-01]

Worked example: Role charter ROLE-NR-SEC-DET

Introduced in Chapter 17.

Illustrative.

# Illustrative role charter, Nordvik Region detection engineer
role_charter:
  id: ROLE-NR-SEC-DET
  under: ROLE-NR-SEC-01        # team charter, AIDR-0716, 2027-01-25
  version: 1.0.0
  organisation: Nordvik Region
  effective: 2027-07-01
  review_by: 2028-07-01
  approved_by: CISO
  holder: Karin Lund
  reports_to: CISO
  functions: [B1 Anticipate, B2 Detect, B5 Learn]
  mandate: >-
    Own the detection content the Region runs, whoever operates the
    platform, and keep it tested, reviewed and current.
  accountabilities:
    - Detection records DET-NR-* have an owner, a test and a review date
    - Supplier default rules are taken over one at a time (AIDR-0701)
    - Weekly sample of the provider's closed alerts is reviewed (AIDR-0712)
    - One weekly hour of intelligence work is done and recorded (AIDR-0705)
  decision_rights:
    - decision: merge a detection change
      right: decide
      condition: second analyst has reviewed
      within: 5 working days
    - decision: retire a rule that has not fired in its review period
      right: decide
      within: 5 working days
    - decision: ask the provider to change a rule under annex MS-1
      right: recommend
      decided_by: CISO
  ceilings:
    own_ai_use: Level 1 Assisted
    approves_actions_up_to: Level 1 Assisted
  may_not:
    - merge own change without a second reader
    - grant a closure class above Level 2 Supervised
  cover: second analyst, named in the rota

Chapter 18: Decision Rights and Escalation

Worked example: Decision-rights file and a tabletop result

Introduced in Chapter 18.

Illustrative.

decision_rights: DRF-HM-SOC-01
version: 1.1.0
decision_record: AIDR-0776
owner: group-ciso
endorsed_by: executive-board
review_by: 2028-06-14
major_incident:
  declared_by: [soc-lead, group-ciso]
  transfers_to: incident-response-lead
  rights: [D4, D5, D6]
decisions:
  D1: {name: preserve-evidence, class: AC-0, executes: MND-HM-SOC-02, level: 3, accountable: head-of-soc-operations, deputy: soc-lead, second_deputy: duty-manager}
  D2: {name: isolate-workstation, class: AC-1, executes: PBK-HM-ISOLATE-01, level: 3, accountable: head-of-soc-operations, deputy: soc-lead, second_deputy: duty-manager, outside_playbook: {holder: duty-analyst, level: 2, within_min: 5}, excluded_tags_route_to: D4}
  D3: {name: revoke-session, class: AC-1, executes: PBK-HM-REVOKE-01, level: 3, accountable: head-of-soc-operations, deputy: soc-lead, second_deputy: duty-manager}
  D4: {name: isolate-production-host, class: AC-2, holder: soc-lead, deputy: incident-commander, second_deputy: incident-response-lead, within_min: 10, deputy_acts_at: level-2-when-holder-unreachable, inform: [platform-on-call, service-owner]}
  D5: {name: disable-account, class: AC-3, holder: incident-commander, deputy: soc-lead, second_deputy: duty-manager, within_min: 10, person_suspected_of_conduct: hr-and-works-agreement-first}
  D6: {name: take-service-offline, class: AC-2, holder: group-ciso, deputy: incident-response-lead, second_deputy: chief-risk-officer, within_min: 30, consult: [service-owner]}
  D7: {name: notify-supervisory-authorities, class: AC-4, holder: group-ciso, deputy: incident-response-lead, second_deputy: chief-risk-officer, acknowledge_min: 10, decide_min: 30, draft_by: HM-SEC-001, draft_level: 1}
  D8: {name: notify-affected-people, class: AC-4, holder: chief-risk-officer, deputy: group-ciso, second_deputy: board-member-on-call, decide_min: 120, advise: [data-protection-officer, entity-accountable-officer]}
  D9: {name: pay-or-refuse-ransom, class: AC-4, holder: executive-board, deputy: board-member-on-call, second_deputy: chief-risk-officer, advise: [group-ciso, legal-counsel], decide_min: 240, agent_role: none}
  D10: {name: stop-agent-or-team, holders: [duty-analyst, shift-lead, incident-commander, agent-operator, soc-lead], deputy: platform-on-call-lead, second_deputy: duty-manager, approval: none, target_seconds: 120, restart: soc-lead}
escalation:
  on_timeout: [deputy, next_tier]
  timer: automatic-in-paging-tool

Worked example: Decision-rights file and a tabletop result

Introduced in Chapter 18.

Illustrative.

tabletop: TTX-HM-2027-Q3-01
held: 2027-07-13
decision_tested: D7
rights_version: 1.0.0
scenario: suspected exfiltration of claims data processed at the Polish service centre
markets: [DE, NL, SE, NO]
facilitator: head-of-detection-engineering
clock:
  human_confirmed_at: "02:40"
  first_page_at: "02:41"
  holder_acknowledged_at: "02:59"
  decision_at: "03:31"
measured:
  acknowledge_min_from_first_page: 18
  decide_min_from_confirmation: 51
  targets: {acknowledge_min: 10, decide_min: 30}
findings:
  - {id: TT-1, what: first page went to a number removed from the rota in May, fix: paging tool reads the rota from the file, owner: head-of-soc-operations, retest: 2027-10-13}
  - {id: TT-2, what: escalation to the deputy was a manual step and did not fire, fix: automatic timer, owner: head-of-soc-operations, retest: 2027-10-13}
  - {id: TT-3, what: the Norwegian board delegation named only the group CISO, so the deputy's decision for NO waited 12 minutes for local confirmation, fix: delegation names the deputy, owner: market-liaison-no, retest: 2027-10-13}

Chapter 19: Regulation as Constraint

Worked example: A reporting-clock profile

Introduced in Chapter 19.

Illustrative.

clock_profile: CLK-HM-01
decision_record: AIDR-0777
incident: INC-HM-2027-0455
case_record: CASE-HM-0455
timestamps:
  first_flag_at: "2027-04-12T02:14:05+02:00"
  human_confirmed_at: "2027-04-12T02:16:40+02:00"
  start_rule: earlier_of_the_two
  opened_at: "2027-04-12T02:14:05+02:00"
clocks:
  - id: dora-initial
    basis: "DORA Articles 17 to 19"
    applies_if: classified_major
    timers:
      - {from: awareness, limit: per_instrument}
      - {from: classification, limit: per_instrument}
    due: earlier_of_timers
    owner: reporting-authority
    draft: ai_level_1
    send: human
  - id: nis2-early-warning
    basis: "NIS 2 Article 23"
    applies_if: entity_in_nis2_scope   # decided per entity by the group's legal function
    limit_hours: 24
    due: "2027-04-13T02:14:05+02:00"
    owner: reporting-authority
    draft: ai_level_1
    send: human
  - id: gdpr-authority
    basis: "GDPR Article 33"
    applies_if: personal_data_compromise_established
    start_rule: when_compromise_established
    limit_hours: 72
    due: null
    owner: data-protection-officer
    draft: ai_level_1
    send: human
checkpoint:
  classify_by: "2027-04-12T04:16:40+02:00"
outcome:
  classified_by: reporting-authority
  classified_at: "2027-04-12T03:40:00+02:00"
  classification: not_major
  personal_data_compromise_established: false
  impact_noted: "the second isolation interrupted a settlement run for a Norwegian claims batch; released at 02:22:15"
  clocks_closed: [dora-initial, nis2-early-warning, gdpr-authority]
  reviewed_in: PIR-HM-0455

Chapter 20: Measuring the Transformed Blue Team

Worked example: reporting/blue-team-page.yaml

Introduced in Chapter 20.

Illustrative.

# reporting/blue-team-page.yaml  (illustrative)
page: BTP-HM-2027-Q3
period: 2027-Q3
owner: group-ciso
reporting_level: team          # never by person
agreed_with: [konzernbetriebsrat, polish-service-centre-representatives]
sources: [OQM-HM-SOC-01, case-register, coverage-map, finding-register, drill-register]
speed:
  counts_period: year-to-date-to-end-of-q3   # includes the April reversal
  time_to_contain_minutes: {median: 6, p90: 21, incidents: 12}   # from first flag
  containment_held: {incidents_with_containment: 12, held: 11, reversed: 1}
  stops: {invoked: 3, precautionary: 2}
  stop_path_seconds:           # last measured, second quarter
    live_2027_04_12: 57
    drill_2027_04_27: 220
    retest_2027_06_03: 106
    target: 120
  gaming_check: reversal_share
coverage:
  priority_techniques: 34
  verified: 25
  declared: 7
  failed: 2
  oldest_passing_test_days: 74
  gaming_check: date_of_last_passing_test
judgement:
  escape_rate_by_class:
    SC-01: {sampled: 640, escapes: 1, rate: 0.002}
    SC-02: {sampled: 520, escapes: 0, upper_bound: 0.006}
  seeds: {injected: 28, caught: 24, caught_seed_rate: 0.86, threshold: 0.80}
  oversight: {proposals: 9600, median_minutes: 4.2, rejection_rate: 0.12,
              reproduction_rate_t2: 0.71, reproduction_target: 0.80, flag: target_missed}
  gaming_check: seeds_set_by_other_than_reviewer
learning:
  finding_to_control_days: {median: 19, p90: 41, findings_closed: 23}
  recurrence_12_months: 0.04
  recoverability: {services_drilled: 6, within_objective: 5}
  gaming_check: closure_requires_passing_retest
decisions_requested:
  - id: req-1
    measure: judgement.oversight.reproduction_rate_t2
    request: hold class SC-03 at Level 2 Supervised through 2027-Q4
  - id: req-2
    measure: coverage.failed
    request: accept two failed cells (T1098, T1567) until 2027-12-15 or fund the work
decision_record: AIDR-0778

Chapter 21: The Analyst at Work

Worked example: Works agreement clause for SOC tooling

Introduced in Chapter 21.

Illustrative.

# Illustrative. Hansa Mutual, SOC annex to KBV-IT-2024 (AIDR-0779).
clause_id: KBV-IT-2024-SOC-04
title: Analyst-activity data in SOC tooling
parties:
  - Konzernbetriebsrat
  - Polish service centre employee representatives
  - Group SOC lead
out_of_scope: [UK late shift, to be settled locally under UK law]
systems_in_scope:
  - group SIEM
  - SOAR layer
  - case management
  - oversight dashboard OQM-HM-SOC-01
change_classes_requiring_notice:
  - new log source that records analyst actions
  - new agent that writes to the review queue
  - new dashboard field that includes a user identifier
reporting:
  level: team_class_quarter
  minimum_group_size: 5
  prohibited:
    - ranking of analysts
    - per-person closure rate
    - per-person approval time
    - missed seeds attributed to a person
use_in_appraisal_or_discipline: forbidden
raw_activity_data:
  purpose: [audit, evidence, incident reconstruction]
  retention_days: 180
  readers: [SOC lead, data protection officer]
  access_log: every read recorded; summary sent monthly to both employee bodies
night_work:
  max_consecutive_night_shifts: 4
  open_proposals_cap_at_night: 8
  stop_right: any reviewer may pause agent proposals for their shift
participation:
  analyst_panel: two analysts per site review dashboards before release
review:
  date: 2027-12-16
  reviewers: [SOC lead, Konzernbetriebsrat chair, Polish representative]

Chapter 22: Competences, Training and Exercises

Worked example: competence record CMP-NR-04

Introduced in Chapter 22.

Illustrative.

# competence/records/CMP-NR-04.yaml (illustrative)
competence_record:
  id: CMP-NR-04
  person_ref: NR-EMP-40417
  role: security_analyst
  framework: {id: SOC-CF-NR, version: "2027.1"}
  assessed_on: 2027-06-09
  exercise: EX-NR-2027-01        # seeded incident, synthetic data
  assessors: [detection_owner, peer_analyst_neighbouring_region]
  purposes: [development_plan, input_to_duty_rota_decision]   # a named person decides the rota
  not_used_for: [individual_performance_ranking, pay_setting, disciplinary_process]
  readers: [record_subject, ciso, hr_competence_partner]
  competences:   # both forms: the lower counts; AGT-02 is assessed in the assisted pass only
    - {id: INV-01, level: practitioner, unassisted: EVD-NR-2027-011, assisted: EVD-NR-2027-012}
    - {id: INV-02, level: foundation,   unassisted: EVD-NR-2027-013, assisted: EVD-NR-2027-014}
    - {id: AGT-02, level: foundation,   assisted_only: EVD-NR-2027-015}   # 1 of 3 seeded errors caught
    - {id: CMD-01, level: foundation,   tabletop: EVD-NR-2027-017}
    - {id: DAT-01, level: practitioner, unassisted: EVD-NR-2027-019, assisted: EVD-NR-2027-020}
  rota_guidance: {INV-01: practitioner, CMD-01: practitioner}   # read by the CISO, who decides
  rota_decision: {by: ciso, recorded_as: AIDR, reasons_recorded: true}
  subject_comment: agrees; asks for a tabletop before the next on-call block
  development_plan:
    learning_path: LP-NR-SOC-2027-01   # decided as AIDR-0725
    protected_time_share: 0.10
    items:
      - {competence: CMD-01, target: practitioner, by: 2027-11-30, means: joint tabletop with neighbouring region}
      - {competence: AGT-02, target: practitioner, by: 2027-12-31, means: seeded-error drills, monthly}
      - {competence: INV-02, target: practitioner, by: 2028-03-31, means: paired case work with detection owner}
  valid_until: 2028-06-09

Worked example: competence conditions on autonomy

Introduced in Chapter 22.

Illustrative.

# competence/conditions.yaml (illustrative)
decision: AIDR-0780
framework: {id: SOC-CF, version: "2027.1", owner: group_soc_lead}
conditions:
  - id: COND-HM-SOC-01
    applies_to: {manifest: MND-HM-SOC-01, ceiling: level_3_bounded, classes: [SC-01, SC-02]}
    requires:
      competence: AGT-03
      level: advanced
      holders_at_least: 2
      per_site: [hamburg, polish_service_centre]
    on_unmet: {ceiling: level_2_supervised, notify: [soc_lead, group_ai_governance_board], rota_decision: soc_lead}
  - id: COND-HM-SOC-02
    applies_to: {manifest: MND-HM-SOC-02, ceiling: level_3_bounded, actions: [workstation_isolation, session_revocation]}
    requires:
      competence: CMD-02
      level: advanced
      holders_at_least: 2
      per_site: [hamburg, polish_service_centre]
      stop_drill_within_days: 90
    on_unmet: {ceiling: level_2_supervised, notify: [soc_lead, incident_response_lead]}
check:
  schedule: nightly
  reads: [level, validity]
  never_reads: [record_content, evidence, working_notes]
  lapse_is: expiry_not_disciplinary_event

Chapter 23: Keeping the Craft and Making New Analysts

Worked example: apprenticeship record for a junior analyst at Hansa Mutual

Introduced in Chapter 23.

Illustrative.

# Illustrative apprenticeship record. Development record: owned by the apprentice.
id: APP-HM-2027-01
decision: AIDR-0781
competence_record: CMP-HM-33          # receives levels only
site: polish-service-centre
start: 2027-11-01
mentor_role: shift-lead
rotation_host: detection-engineering  # one day in five, from stage S2
works_agreement: KBV-IT-2024 (SOC annex, development records)
visible_to: [apprentice, mentor, soc_lead_stage_only]
forbidden_uses: [pay, ranking, dismissal, performance_rating, team_reporting_by_name]
assistant_rule: attempt_first_then_ask    # recorded in the case
unassisted_share: {core_work: 1.0, until: 2028-04-30}
stages:
  - id: S1
    window: [2027-11-01, 2028-01-31]
    may: [shadow_queue, case_replay, hunt_reader, post_incident_scribe]
    may_not: [close_on_live_queue, approve_agent_proposal]
  - id: S2
    window: [2028-02-01, 2028-04-30]
    may: [work_SC-03_alerts_in_shadow_queue, write_detection_tests]
    may_not: [approve_agent_proposal]
  - id: S3
    window: [2028-05-01, 2028-10-31]
    may: [review_level_2_proposals_tier_T1, run_manual_isolation_in_drill]
    may_not: [owner_of_a_level_3_class]
stage_gate:
  assessed_by: demonstration      # method agreed with representatives before day one
  demonstrations:
    - cases worked unassisted and read by the mentor against the rubric
    - replays and seeded incidents judged against a written answer
    - manual isolation by PBK-HM-ISOLATE-01 in a drill, within the playbook's drill target
    - two detection tests merged
    - two night shifts shadowed
  decided_by: [mentor, soc_lead]  # the tooling never decides
  tool_decides: false
  on_not_met: [extend_stage, add_mentoring]
  never: [removal_from_post]
review: {dates: [2028-02-01, 2028-05-02, 2028-08-01, 2028-10-31], by: [mentor, soc_lead, apprentice]}

Chapter 24: The Future of the Blue Team

Worked example: Horizon register HZN-HM-BT-01 (illustrative)

Introduced in Chapter 24.

Illustrative.

register: HZN-HM-BT-01
decision: AIDR-0782
owner: ROLE-HM-SOC-01
scope: Hansa's own records; shows the mechanism, not the industry
reviewed: 2027-11-22
next_review: 2028-11-21
trends:
  - id: HM-T1
    label: observable
    statement: Routine triage is automated; people verify a sample (B3)
    evidence: HM-SEC-006 closes SC-01 and SC-02; PIR and OQM records
    trigger: closure classes at Level 3 rise above 4 without PIR support
    posture: commit
  - id: HM-T2
    label: observable
    statement: Detection work is engineering on versioned records (B2, B5)
    evidence: 48 drafts, 15 merged in 2027-Q1; DET-HM records
    trigger: merged-to-drafted ratio below 0.2 for two quarters
    posture: commit
  - id: HM-T3
    label: expected
    statement: Adversary AI shortens the time to exploit (B1, B2, B4)
    evidence: NCSC 2025 assessment, horizon 2027
    trigger: median time to contain exceeds the exploit window in HNT records
    posture: prepare
  - id: HM-T4
    label: expected
    statement: More reversible response classes move to Level 3 (B4)
    evidence: NCSC 2025 trend; PBK-HM-ISOLATE-01 record; PIR-HM-0455 findings
    trigger: seeded catch below 0.80 in two quarters stops any move
    posture: prepare
  - id: HM-T5
    label: expected
    statement: Entry-level triage posts shrink; the route to seniors thins (B3)
    evidence: AIDR-0775 conversion of four tier 1 posts; Chapter 23 programme
    trigger: no promotion from tier 1 to investigation lead in 24 months
    posture: prepare
  - id: HM-T6
    label: observable
    statement: Management bodies carry cyber duties in force (DORA Art 5) (B4)
    evidence: instruments in force
    trigger: amendment or supervisory statement on machine accountability
    posture: commit
  - id: HM-T7
    label: speculation
    statement: A managed service replaces the in-house SOC outside the core
    evidence: none in group; provider marketing only
    trigger: provider offers stated autonomy, notice and liability terms
    posture: keep reversible
  - id: HM-T8
    label: speculation
    statement: Cross-function autonomy without a named human incident commander
    evidence: none; contradicts the Level 4 rule for irreversible B4 actions
    trigger: supervisor accepts machine-held accountability in writing
    posture: keep reversible

Worked example: Horizon register HZN-NR-BT-01 (illustrative)

Introduced in Chapter 24.

Illustrative.

register: HZN-NR-BT-01
decision: AIDR-0727
owner: ROLE-NR-SEC-01
scope: Nordvik's own records; shows the mechanism, not the industry
reviewed: 2027-11-15
next_review: 2028-11-14
trends:
  - id: NR-T1
    label: observable
    statement: The provider's AI closes alerts out of hours (B3)
    evidence: AIDR-0712 weekly sampling; CASE-NR-0231
    trigger: sampled reopen rate above 0.05 in any quarter
    posture: commit
  - id: NR-T2
    label: observable
    statement: Rules owned by the Region are fewer than rules owned by the provider (B2)
    evidence: AIDR-0701 takeover of rules one at a time; DET-NR-0001
    trigger: fewer than 12 owned detection records by 2028-06
    posture: commit
  - id: NR-T3
    label: expected
    statement: Provider consolidation raises exit cost (B2, B3, B4)
    evidence: market notices; annex MS-2 notice terms (AIDR-0722)
    trigger: notice of change or ownership under the framework agreement
    posture: prepare
  - id: NR-T4
    label: expected
    statement: Adversary AI shortens the time between exposure and use (B1, B4)
    evidence: NCSC 2025 assessment, horizon 2027
    trigger: exposure items older than 7 days with exploitation reported
    posture: prepare
  - id: NR-T5
    label: expected
    statement: Too few people can verify the provider's closures and the entry route is thin (B3, B5)
    evidence: two analysts who read raw alert data; one trainee post (AIDR-0726)
    trigger: fewer than two analysts able to sample the provider's closures
    posture: prepare
  - id: NR-T6
    label: speculation
    statement: A national or EU-level shared SOC service replaces local analysts
    evidence: none for the Region; EU instruments in force only
    trigger: a shared service offered with terms for autonomy and notice
    posture: keep reversible

Chapter 25: Case Studies and Anti-Patterns

Worked example: Anti-pattern record AP-HM-SOC-01 (illustrative)

Introduced in Chapter 25.

Illustrative.

anti_pattern:
  id: AP-HM-SOC-01
  name: rubber-stamp review
  organisation: Hansa Mutual
  functions: [B3 Investigate, B4 Respond]
  status: mitigated          # open | mitigated | closed
  decision: AIDR-0783
  recorded: 2027-10-21       # illustrative
pattern: >
  Human approval of agent proposals is given in seconds, so the
  approval no longer verifies anything.
evidence:
  - source: OQM-HM-SOC-01
    finding: median approval fell sharply while proposals tripled; Q3 median 4.2 minutes
    volume: 3.0x the 2026 baseline
  - source: INC-HM-2027-0455
    finding: second isolation approved at Level 2 in 38 seconds, reversed
control:
  protocol: reviews/protocol/soc-tiers.yaml
  decision: AIDR-0769
  measures:
    reproduction_required_at: Level 2 Supervised
    critique_agent: second model family
    open_proposals_cap: { day: 12, night: 8 }
    seeded_errors: 0.05
    seeded_catch_threshold: 0.80
  reporting: aggregate only, agreed with employee representatives
owner: soc-lead
accountable_for_class: class-owner-named-in-CLOSE-HM-SOC
retest:
  due: 2028-01-15
  closes_on: seeded catch at or above 0.80 for two consecutive quarters

Chapter 26: A Year on the Blue Team

Worked example: A year-in-review register

Introduced in Chapter 26.

Illustrative.

year_in_review:
  organisation: hansa-mutual
  year: 2027
  basis: records-only
  signed_by: group-ciso
  checked_by: independent-reviewer
  commission: AIDR-0750
  incident:
    id: INC-HM-2027-0455
    case: CASE-HM-0455
    review: PIR-HM-0455
    review_held: 2027-05-06
    review_closed: 2027-06-03
    assessment: legitimate rollout CHG-PL-2291, not major, no data access
    stop_seconds: 57
    stop_target_seconds: 120
    reversals: 1       # A2, after approval
    releases: 1        # A1, released on the assessment of a legitimate rollout
    approval_seconds_reversed_action: 38
  controls:
    verified:
      - pdp-denies-out-of-scope-isolation
      - isolation-needs-two-independent-data-paths   # playbook v2.1.0
      - stop-from-shift-lead-console                 # drill 2027-06-03, 106 seconds
    failed_then_fixed:
      - control: trust-label-inheritance
        finding: FND-HM-2027-014
        retest_passed: 2027-06-21
      - control: stop-drill-within-target
        finding: FND-HM-0455-3
        drill_seconds: [220, 106]
        retest_passed: 2027-06-03
    declared:
      - detection-drafting-queue-limit
  oversight_q3:
    report: OQM-HM-SOC-01
    proposals: 9600
    baseline_multiple: 3.0
    median_approval_minutes: 4.2
    rejection_rate: 0.12
    seeds_caught: [24, 28]
    reproduction_rate: 0.71
    reproduction_target: 0.80      # missed, flagged in the report
    unassisted_share: { policy: 0.20, observed: 0.10 }
    reporting: aggregate-only
  agreements:
    interim_letter: 2027-01-27
    soc_annex_to: KBV-IT-2024
    signed: 2027-10-28
  next_decisions:
    - { id: pending, due: 2028-02-09, owner: soc-lead, item: renew-mandate-MND-HM-SOC-02 }

Chapter 27: Nordvik Region and Hansa Mutual

Worked example: the two plans as code

Introduced in Chapter 27.

Illustrative.

# plans/blue-team-2027-2029.yaml (Nordvik Region, illustrative)
plan: PLAN-NR-BT-2027
decision_record: AIDR-0736
conclusion_record: AIDR-0713
owner: chief-information-security-officer
approved_by: regional-executive-committee
period: {from: 2027-10-01, to: 2029-09-30}
constraint: six analysts working office hours; detection content partly held by the provider
already_decided: [AIDR-0719, AIDR-0726, AIDR-0732]
measures:
  - id: N1-B1
    what: Two hunts a year, each ending in a detection or a dated coverage statement
    owner: detection-owner
    due: every six months from 2028-03-31
    verify: hunt records closed within 60 days
  - id: N2-B2
    what: All twelve local rules owned, with test and second reviewer; a second analyst can change one unaided
    owner: chief-information-security-officer
    due: 2028-09-30
    verify: tests passed within 90 days; exercise passed
  - id: N3-B3
    what: Annex MS-2 signed with notice of model change; provider closures sampled and seeded
    owner: chief-information-security-officer
    due: 2028-03-31
    verify: five seeded incidents per class per quarter, at least four escalated, otherwise the class returns to a person
  - id: N4-B4
    what: Stop of the provider's AI drilled under MS-2; own out-of-hours stop held to budget
    owner: chief-information-security-officer
    due: 2028-06-30
    verify: provider's AI stopped within 15 minutes; own stop within 10 minutes (AIDR-0731); one drill out of hours
  - id: N5-B5
    what: Findings close on a passed re-test; one joint exercise a year with a neighbouring region
    owner: detection-owner
    due: 2028-09-30
    verify: no finding older than 180 days without a decision
  - id: N6-B3B5
    what: Trainee post filled; half of the trainee's cases unassisted in year one
    owner: chief-information-security-officer
    due: 2028-06-30
    verify: seeded incident worked unaided within 12 months
decisions_for_regional_executive_committee: [MS-2 as a condition of renewal, funding for 2028, cost of the drills]
review: {quarterly: CISO, half_yearly: regional-executive-committee, first: 2028-03-31, final: 2029-09-30}
revise_on: [provider change of control, notice of a model change, detection owner leaves, relevant alert closed by provider AI]

Worked example: the two plans as code

Introduced in Chapter 27.

Illustrative.

# plans/blue-team-2027-2029.yaml (Hansa Mutual, illustrative)
plan: PLAN-HM-BT-2027
decision_record: AIDR-0793
conclusion_record: AIDR-0767
owner: soc-lead
approved_by: group-ciso
period: {from: 2027-10-01, to: 2029-09-30}
constraint: review capacity; two sites; seven regimes
already_decided: [AIDR-0765, AIDR-0769, AIDR-0775]
measures:
  - id: H1-B3
    what: Level 3 Bounded for the next closure class only on its own evidence, with review quality as a second condition
    owner: soc-lead
    grantor: group-ai-governance-board
    due: earliest 2028-04-01
    verify: class record shows no escape in the sample and seeded catch at or above 0.85 for two quarters; OQM-HM-SOC-01 catch at or above 0.80 and reproduction at target; below 0.80 the class returns to Level 2
  - id: H2-B1B2
    what: No rule merged without a test; accepted intelligence converted or dated-rejected
    owner: head-of-detection-engineering
    due: 2028-03-31
    verify: oldest unreviewed AI draft at most 10 working days; conversion within 30 days
  - id: H3-B4
    what: Stop of HM-SEC-001 kept at target; degraded mode drilled each quarter
    owner: soc-lead
    due: 2028-06-30
    verify: two consecutive drills at or under 120 seconds; manual queue within 15 minutes
  - id: H4-B3B5
    what: Pyramid change of AIDR-0775 carried out; observed unassisted share brought to one case in five
    owner: soc-lead
    due: 2028-06-30
    verify: observed share 0.20 read quarterly; seeded exercise unaided each year; nothing by person
  - id: H5-B5
    what: No finding older than 90 days without a decision; containment exercise repeated each May
    owner: head-of-detection-engineering
    due: exercise each May from 2028
    verify: findings register
  - id: H6-B4
    what: Reporting and consultation across seven regimes run as one practice
    owner: group-ciso
    due: 2028-06-30
    verify: notices drafted before half of the shortest clock has run   # clocks: limit per_instrument
decisions_for_executive_board: [conditions for further delegation, protected time, risk appetite for the night]
review: {quarterly: group-ciso, half_yearly: group-ai-governance-board, yearly: executive-board, first: 2028-03-31}
revise_on: [seeded catch below 0.80, new Mode 5 agent, change in UK or Swiss regime, change to KBV-IT-2024, stopped agent in a major incident]

Chapter 28: Conclusions

Worked example: The author's horizon statement

Introduced in Chapter 28.

Illustrative.

# horizon/author-statement-2036.yaml  (illustrative format; the author's projection)
statement: HZN-BT-AUTHOR-2036
version: 1.0.0
written: 2026-11-10
review_date: 2027-11-10
reviewer_role: author-with-two-external-readers
claims:
  - id: H1
    claim: Defined low-risk alert classes are closed by systems under named class owners.
    label: expected
    basis: closure of low-risk classes is observable now (Chapter 7)
    revise_if: published audits show escape rates above the class stop number
  - id: H2
    claim: Detection engineering, novel investigation and learning are done by people conducting systems.
    label: expected
    basis: tested drafts, seeded review and re-tests (Chapters 6, 8, 11)
    revise_if: machine-checkable reasoning removes the need for independent reproduction
  - id: H3
    claim: Wide, irreversible and person-related actions, and disclosure, stay with named people.
    label: expected
    basis: the Level 4 rule; accountability on the management body in NIS 2 Article 20 and DORA Article 5
    revise_if: law or audited multi-year evidence changes the allocation
  - id: H4
    claim: The unit that does this work is still organised as a tiered SOC.
    label: speculation
    revise_if: published staffing data show tiered SOCs below half of surveyed teams (Chapter 24)
  - id: H5
    claim: A fully autonomous detection and response service outperforms a supervised team over years.
    label: speculation
    revise_if: audited escape-rate, recovery and harm data over at least three years
  - id: H6
    claim: Entry routes exist that do not depend on tier-1 triage.
    label: speculation
    risk: the entry rung is lost if no route is designed (Chapter 23)

Nordvik Region and Hansa Mutual

Introduced in Chapter 28.

Illustrative.

# reviews/final-test-2027.yaml  (illustrative)
final_test:
  - decision_record: AIDR-0737
    organisation: Nordvik Region
    dated: 2027-12-15
    reviewers: [hr-lead, ai-architect, data-protection-officer]
    review_by: 2028-12-15
    tests:
      - question: Who decided what the provider's AI may close?
        method: Trace CASE-NR-0231 to class, owner, sample and reopening.
        result: partly
        note: Sampling (AIDR-0712) and reopening are ours; the provider's rule is not in our records until annex MS-2 is signed.
        next: Obtain the class list under MS-2; owner Karin Lund.
      - question: Can we stop the provider's AI closing alerts out of hours?
        method: Ask the provider to suspend AI closure for one night and time it.
        result: not_yet_shown
        target_minutes: 15          # annex MS-2 stop budget
        next: Run the test with the duty analyst; owner CISO.
  - decision_record: AIDR-0794
    organisation: Hansa Mutual
    dated: 2027-12-15
    reviewers: [chief-risk-officer, head-of-detection-engineering, ai-governance-board-chair]
    review_by: 2028-12-15
    tests:
      - question: Who or what decided each action in INC-HM-2027-0455?
        method: Rebuild from CASE-HM-0455 and PIR-HM-0455.
        result: yes
        note: Each action maps to a playbook or a named role; the 38-second approval was read as a signal and the shift lead reversed it.
      - question: Can we stop the agents and recover?
        method: Compare the stop of the night (57 s) and the re-tested drill (106 s, 2027-06-03) with the 120 s target; compare the degraded-mode drill (14 min 20 s, 2027-06-22) with 15 min.
        result: yes_with_open_item
        note: The stop and the manual queue are verified. Open item - independent reproduction of Level 2 proposals was 0.71 against 0.80 in 2027-Q3 (OQM-HM-SOC-01).
        next: Bring reproduction to 0.80 as the second condition of gate H1; owner SOC lead.