Dark › Module 9 › Lesson 2
Stakeholder Comms
Incident reporting literacy — incident ID, timeline UTC stub, affected assets, containment action, evidence link — named incident rows on YOUR `$DW_LAB` fictional org.
Visual · t39_incident_reporting
Incident reporting = named IR rows. $DW_LAB. Original Cyberlium.
Opening
Dark-web-related incidents need structured reports — name incident report rows on YOUR lab org before filing incomplete reports or including unauthorized stranger data.
Incident reporting literacy names: incident ID link category, timeline UTC stub category, affected assets category, containment action category, and evidence link category. Analyst documents incident report outline on `$DW_LAB` fictional org — three incident scenarios from Module 6–8 findings labeled LAB — without filing reports on stranger org incidents without authorization, without omitting timeline gaps dishonestly, without attaching crime how-tos or marketplace screenshots, without mixing unverified rumors as confirmed facts. Cyberlium teaches IR reporting vocabulary on YOUR notes. Refused: unauthorized stranger org reports, rumor-as-fact, crime artifact attachments. Lab row: incident report outline (three scenarios, timeline UTC, evidence link LAB, containment stub).
1. Named incident rows
Incident ID, timeline UTC, affected assets, containment, evidence link — five anchors.
Each scenario links Module 6 leak and Module 8 TI thread — same org continuity.
Command guide
Try these commands — Named incident rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA IR — https://www.cisa.gov/topics/cyber-threats-and-advisories FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export DW_LAB=${DW_LAB:-$HOME/cyberlium-lab/t39-dw}
cat > "$DW_REPORTING/incident-report-template.md" <<'EOF'
# Incident Report Template — LAB-SAMPLE
## Summary
FAKE-CORP-001 dark-web credential mention — vendor alert DW-001
## Timeline (UTC)
- Detect: YYYY-MM-DDTHH:MMZ
- Triage: YYYY-MM-DDTHH:MMZ
- Contain: force reset + MFA
## IOC stub
domain: example.com | label: LAB-SAMPLE
## Refusals
No marketplace buys; no unauthorized collection; consult legal for real incidents
EOFCommand — copy this
grep -E 'Timeline|LAB-SAMPLE|Refusals' "$DW_REPORTING/incident-report-template.md"
Primary tools to practice this lesson: grep. Reference sites: NIST 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA IR (https://www.cisa.gov/topics/cyber-threats-and-advisories); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Timeline discipline
Timeline UTC stub documented with honest gaps — not backfilled fiction.
Evidence links cite LAB samples only — not stranger prod screenshots.
3. Refused
No unauthorized stranger org reports; no rumor-as-fact; no crime artifact attachments.
Incident literacy supports accountable response — not blame theater.
4. What you ship: incident report outline
Three scenarios + timeline UTC + evidence link LAB + containment + NEVER rumor-as-fact line.
5. What you record before the next lesson
Incident report outline path.
6. Wrong vs right: criminal markets vs YOUR OPSEC lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
File incident report on stranger org breach using public dump data without authorization as 'incident reporting lab.'
Right
Incident report outline from `$DW_LAB` findings. Next: Lessons Learned.
Mission: incident report outline
1) Name five incident reporting literacy rows. 2) Three scenarios from Module 6–8 thread. 3) Timeline UTC and evidence link each. 4) Write NEVER rumor-as-fact line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Timeline UTC — minimum event rows?”
Knowledge Check
APPLY: Incident reporting literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Unverified rumors may be stated as confirmed facts.
True or False
Knowledge Check
APPLY: Incident report includes:
Multiple choice