[righel]

Adds tutorial/workshop.md, a hands-on workshop guide in the style of tutorial.md. It follows one scenario: ACME Bank's SOC handling a phishing campaign against its treasury team.

Time	Module	Lab
0:10	Ingest	An uploaded (offline) freetext feed, a batch-imported vendor report, and what normalisation refangs and flags
0:30	Curate	Confidence scores, a feed's score modifier and cap, an organisation warninglist, a Perimeter block detection profile with required approval, the review queue
0:55	Share	A Palo Alto EDL, Suricata rules and a DNS RPZ zone from the profile, and a live Wazuh manager pulling it as a CDB list with a matching rule
1:20	Close the loop	Wazuh's alerts, posted to an alert webhook through its shuffle integration, become sightings
+20	Bonus	A retro-hunt notebook (mwlab) and a reactor script that tags campaign infrastructure on arrival

It also includes:

• pre-session setup (seed-demo, an API key from the SIEM preset), with the lab files inline;
• must-do and if-you-have-time steps in each lab;
• facilitator notes and troubleshooting;
• cleanup steps and links to the docs.

The menu paths follow the navigation from #472.

Checked:

• every screenshot and docs link resolves;
• the CDB streaming export with a profile, against dev;
• Lab 4's alert, run through the Wazuh preset's mapping with the read-only Try it endpoint.

Not run end to end: the labs write to the database, so nobody has clicked through them yet. The Wazuh steps (the CDB list, the rule and the integration) are written from Wazuh 4.x conventions. Both are worth a dry run before the session.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.56%. Comparing base (0e706f9) to head (736cb0b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #478   +/-   ##
=======================================
  Coverage   88.56%   88.56%           
=======================================
  Files         292      292           
  Lines       34263    34272    +9     
=======================================
+ Hits        30345    30354    +9     
  Misses       3918     3918           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[righel]

Follow-ups from playing the workshop end to end (now scripted: npm run workshop:screenshots):

• Screenshots are now the intended outcome of each lab, captured from a real run, instead of reused feature-doc screenshots.
• Guide: Lab 2a's query value:*example-cobalt* matched nothing and is now value:*cobalt*. Lab 3a no longer asks for Subdomains too on PAN-OS, where it is disabled, and points to PAN-OS's own Automatically expand to include subdomains instead.
• Fix: a deleted event no longer blocks creating a new one with the same info. Includes a regression test.
• Seed: c2.example-cobalt.net keeps 1 false positive instead of 5. With 5 it scored 30, below the Perimeter block profile's 60, so it could never be approved in Lab 2e.

Depends on #484. Without it, Import Data drops the defanged lines of Lab 1b's vendor report (2 of 8 valid).

🤖 Generated with Claude Code

[github-actions]

OpenAPI changes

No changes to the OpenAPI spec.