Hi Bein, 

There's quite a few ways to do this.  You could start out with some benign testing, using something such as a powershell or dos command(assuming this data goes to SecOps).  Create an rule for the cli output and set the rule to live.  Once the case gets into SOAR, you would click on the case, select the event and then hit the 3 cirlces on the right to "ingest as test case". This would allow you test playbook triggers, some opportunities for integrations/enrichments and workflows.   

You could also ingest data using the ingestion API or setup a bindplane agent on some windows devices and potentially run some scenarios through that mechanism.  

I am fortunate, I can use the Mandiant Security Validation toolset on my devices which funnels into my SecOps instance and from there I can produce events that trigger alerts ultimately creating cases.  

Everything really starts with rules though on the SIEM side which create alerts which turn into cases.  Cases then can trigger playbooks accordingly.   Hope that helps.