Write an enrichment playbook that fails loudly

short · 55 min · Objective 3.1

Task

Build an enrichment step that gathers context from three sources, and make it distinguish 'no result' from 'no answer' -- which is the difference between a case handled and a case mishandled.

Steps

  1. Write lab/enrich.py taking an entity -- a user or a host -- and returning asset owner, recent authentication and prior sightings.
  2. For each source, return a THREE-state result: found, not found, or unavailable. Never collapse unavailable into not-found.
  3. Write the enriched case to lab/case.json, carrying the state of each enrichment alongside its value.
  4. Break one source deliberately -- wrong credential, wrong endpoint -- and run again. Confirm the case records unavailable rather than an absent result, and capture it in lab/enrich-degraded.json.
  5. Add a rule that the playbook FAILS rather than proceeds when a source that matters is unavailable, and demonstrate it.

Verify

python lab/enrich.py testuser > /dev/null; echo "enrich exit=$?"
grep -Eo '"(found|not_found|unavailable)"' lab/case.json | sort | uniq -c
grep -c 'unavailable' lab/enrich-degraded.json

All three states present across the two case files, and unavailable appearing in the degraded run. A playbook recording 'no prior sightings' when the source was unreachable has turned absent evidence into negative evidence, and the case looks handled.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.