Dark › Module 8 › Lesson 4
Lab — Handoff
TI handoff lab on `$DW_LAB` — STIX handoff card, TI platform workflow, sharing boundaries bundled.
Visual · t39_ti_handoff_lab
Lab: TI handoff pack on YOUR $DW_LAB. Original Cyberlium.
Opening
Ship TI handoff artifacts from YOUR lab thread — STIX, platform workflow, sharing boundaries — zero unverified rumors or unauthorized export.
On YOUR `$DW_LAB` per brief: (1) scope proof — Module 7 legal ethics pack labeled; (2) STIX handoff card Module 8-1; (3) TI platform workflow card Module 8-2; (4) sharing boundaries card Module 8-3; (5) TI handoff summary stub (IOC count, TLP distribution, triage count, retirement rows); (6) integrity — `$DW_LAB` only, TLP on all IOCs, no feed pollution, no public restricted intel, no crime how-tos, no unauthorized export; (7) chmod 600 pack. Cross-link Modules 6–7 defender findings — professional TI handoff.
1. Lab deliverables
STIX + platform + sharing cross-indexed to Module 6–7 findings.
Summary cites honest confidence and TLP distribution — not all-RED drama fiction.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OASIS STIX — https://oasis-open.github.io/cti-documentation/ MISP — https://www.misp-project.org/documentation/ MITRE ATT&CK — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
export DW_LAB=${DW_LAB:-$HOME/cyberlium-lab/t39-dw}
cat > "$DW_TI/ti-handoff-lab-pack.md" <<'EOF'
# TI Handoff Lab Pack — YOUR lab
- stix-ioc-handoff-stub.json: FAKE indicator bundle
- ti-platform-literacy.txt: MISP/OpenCTI workflow rows
- sharing-boundaries.txt: TLP + need-to-know
## Refusals
- No criminal dump imports; no public paste of live marketplace URLs
EOFCommand — copy this
grep -E 'stix-ioc|Refusals|TLP' "$DW_TI/ti-handoff-lab-pack.md" grep LAB-SAMPLE "$DW_TI/stix-ioc-handoff-stub.json" "$DW_TI/sharing-boundaries.txt"
Primary tools to practice this lesson: grep. Reference sites: OASIS STIX (https://oasis-open.github.io/cti-documentation/); MISP (https://www.misp-project.org/documentation/); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Every IOC LAB-labeled with TLP — not unverified marketplace chatter.
Zero crime how-to attachments in TI pack.
3. Teardown
Secure notes chmod 600; TI handoff pack ready for reporting module.
Archive stub optional per brief.
4. What you ship: TI handoff lab pack
STIX + platform + sharing + summary + integrity — chmod 600.
5. What you record before the next lesson
TI handoff lab pack path.
6. Wrong vs right: criminal markets vs YOUR OPSEC lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
TI handoff lab includes unverified marketplace rumor feed export as bonus deliverable.
Right
TI handoff lab pack on `$DW_LAB` LAB-labeled IOCs. Next: quiz.
Mission: TI handoff lab
1) Scope and Module 7 legal ethics proof. 2) STIX handoff and platform workflow cards. 3) Sharing boundaries with TLP gates. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “TI summary — minimum TLP honesty rows?”
Knowledge Check
APPLY: TI handoff lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Feed pollution earns TI handoff lab credit.
True or False
Knowledge Check
APPLY: TI handoff lab pack should:
Multiple choice