Defensive › Module 10 › Lesson 4
Capstone Lab
Execute checklist walk on $LAB — evidence index complete, full teardown documented.
Visual · t16_capstone_lab
Capstone: checklist × $LAB evidence. Original Cyberlium.
Opening
Close the loop on hosts you own — then leave them patched, logged, and backed up.
Walk Topic 16 checklist on YOUR $LAB fleet: verify RoE file, spot-check hardening, sample auth log lines, confirm central forward or honest N/A, open policy lab and backup restore records, run awareness pledge line. Update evidence index. Teardown: revert temp configs, stop collectors if lab-only, verify backup catalog, chmod 600 all notes. No stranger hosts, no phishing, no unauthorized changes.
1. Execute checklist
Check each row; link artifact or N/A with reason.
Screenshot or text evidence redacted.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Defensive capstone — https://www.cisecurity.org/controls MITRE ATT&CK — https://attack.mitre.org/matrices/enterprise/ NIST CSF — https://www.nist.gov/cyberframework
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
Command — copy this
sudo apt install curl sudo apt install python3
macOS: Use: netstat
Command — copy this
brew install python3
Windows: Use: netstat Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
ss -tulpn 2>/dev/null | tee "$HOME/cyberlium-lab/t16-defense/capstone-ports.txt" | head -15
journalctl -n 30 --no-pager 2>/dev/null | tee "$HOME/cyberlium-lab/t16-defense/capstone-logs.txt" | head -10
sudo ufw status verbose 2>/dev/null || sudo iptables -L -n 2>/dev/null | head -10 || true
curl -sS http://127.0.0.1/ -o /dev/null -w "local HTTP %{http_code}
"; python3 -c "print('capstone evidence in ~/cyberlium-lab/t16-defense/')"Primary tools to practice this lesson: ss, journalctl, curl, python3. Reference sites: Defensive capstone (https://www.cisecurity.org/controls); MITRE ATT&CK (https://attack.mitre.org/matrices/enterprise/); NIST CSF (https://www.nist.gov/cyberframework). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender paragraph
One paragraph: what your central logs would show if auth failures spiked on $LAB.
Contrast with proper patch/backup discipline.
3. Shutdown
Stop lab collectors/listeners. Secure backups. Sign completion in index.
Lab hosts left in hardened baseline state.
4. What you ship: capstone evidence pack complete
Checked checklist + updated index + teardown proof.
5. What you record before the next lesson
Capstone pack path. Lab quiet.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone evidence from employer network without authorization.
Right
Capstone complete on $LAB. Next: topic quiz.
Mission: Topic 16 capstone
1) Walk checklist with evidence links. 2) Defender paragraph from your logs. 3) Full teardown documented.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Phishing capstone on classmates is credit.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice