Cloud › Module 9 › Lesson 1
Finding Writeups
Finding writeup literacy — title, impact, evidence, repro boundary, remediation — on `$CLOUD_LAB` scan findings only.
Visual · t31_finding_writeups
Finding writeups = named report rows. $CLOUD_LAB. Original Cyberlium.
Opening
Tools output findings — professional writeups turn scanner rows into fixable tickets on YOUR lab evidence.
Finding writeup literacy names: clear title, affected resource, impact statement category, evidence citation (scan output, manifest line), reproduction boundary (lab steps only — no stranger exploit), remediation recommendation, and severity aligned to org scale category. Analyst drafts one complete finding writeup from `$CLOUD_LAB` CSPM or IaC row Modules 8–6 — cites evidence path UTC — without paste of prod case data without RoE, without exploit PoC in repro section, without exaggerated impact claims. Cyberlium teaches mentor-readable cloud finding format — defender reporting hygiene. Refused: stranger tenant finding paste, escape PoC repro steps, prod screenshot without authorization. Lab row: one full finding writeup template filled for lab misconfig.
1. Writeup sections
Title, resource, impact, evidence, repro boundary, remediation, severity — seven literacy anchors.
Repro boundary states lab-only steps — refuses stranger exploit chain.
Command guide
Try these commands — Writeup sections
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
AWS finding format — https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html Azure recommendation — https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference NIST RA-5 — https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final (vulnerability management)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/findings/finding-writeup-template.md" <<'EOF'
# Cloud Finding Writeup — YOUR account
## Title
S3 bucket missing Block Public Access (example)
## Severity
High
## Affected resource
arn:aws:s3:::your-bucket-name (YOUR account)
## Description
Bucket allows public ACL/policy — data exposure risk
## Evidence
aws s3api get-public-access-block output (YOUR account)
## Remediation
Enable account + bucket Block Public Access; review bucket policy
## Scope statement
Authorized review of YOUR resources only
EOFCommand — copy this
grep -E 'Severity|Remediation|YOUR account' "$CLOUD_LAB/findings/finding-writeup-template.md"
Primary tools to practice this lesson: grep, python3. Reference sites: AWS finding format (https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html); Azure recommendation (https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference); NIST RA-5 (https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence discipline
Cite scan output line or manifest snippet from `$CLOUD_LAB` pack.
Redact account IDs in share-safe copy per brief.
3. Refused
No exploit PoC in repro; no prod case paste; no fabricated critical without evidence.
Writeup literacy supports remediation — not offensive demonstration.
4. What you ship: finding writeup template
One complete lab finding writeup + repro boundary + NEVER exploit PoC line.
5. What you record before the next lesson
Finding writeup template path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include container escape PoC steps in finding repro section for 'impact proof.'
Right
Finding writeup from `$CLOUD_LAB` scan row. Next: Remediation Priority.
Mission: finding writeup template
1) List seven writeup sections. 2) Fill template for one lab finding. 3) Evidence citation UTC. 4) Write NEVER exploit PoC repro line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Impact statement — literacy vs FUD?”
Knowledge Check
APPLY: Finding writeup uses:
Multiple choice
Knowledge Check
APPLY: True or False: Escape PoC in writeup repro is lab.
True or False
Knowledge Check
APPLY: Writeup repro boundary:
Multiple choice