Defensive › Module 10 › Lesson 2
Evidence Pack
Index redacted lab artifacts — OS logs, central test, policy, backup restore proof.
Visual · t16_evidence_pack
Evidence pack = table of contents for YOUR lab work. Original Cyberlium.
Opening
Investigators trust indexed evidence — not a folder called stuff_final2.
Build evidence pack index listing each capstone artifact: path, date, one-line description, redaction note. Include OS log lab, central forward confirmation, policy lab file, backup restore log, hardening checklist references from earlier modules. All from $LAB — no employer tickets, no classmate logs, no production screenshots without authorization. chmod 600 index.
1. Index fields
Artifact name, module lesson, file path, UTC date, description, redactions applied.
Cross-link checklist item to artifact row.
Command guide
Try these commands — Index fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence pack — https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html NIST SP 800-92 — https://csrc.nist.gov/publications/detail/sp/800-92/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
Built-in (iproute2)
macOS:
Command — copy this
brew install python3
Use: netstat
Windows: Download https://python.org/downloads/ Use: netstat
═══ LINUX / macOS ═══
Command — copy this
ss -tulpn 2>/dev/null > "$HOME/cyberlium-lab/t16-defense/evidence-ports.txt"
journalctl -n 50 --no-pager 2>/dev/null > "$HOME/cyberlium-lab/t16-defense/evidence-logs.txt"
python3 -c "import os; d=os.path.expanduser('~/cyberlium-lab/t16-defense'); print('evidence files', [f for f in os.listdir(d) if f.startswith('evidence')])" 2>/dev/null || ls "$HOME/cyberlium-lab/t16-defense/evidence-"* 2>/dev/nullPrimary tools to practice this lesson: journalctl, python3, ss. Reference sites: Evidence pack (https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html); NIST SP 800-92 (https://csrc.nist.gov/publications/detail/sp/800-92/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Redaction rules
Remove real names, IPs outside lab range, serial numbers if sharing mentor.
Keep enough to prove you did the work on YOUR hosts.
3. Integrity habit
Optional: hash index file after final edit for personal record.
No uploading pack to public repos.
4. What you ship: evidence pack index
Index table with ≥5 artifacts from $LAB modules.
5. What you record before the next lesson
Evidence index path.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include employer incident ticket in student pack without permission.
Right
Index redacted artifacts. Next: walkthrough.
Mission: evidence index
1) List OS log + central + policy + backup artifacts. 2) Add path and date each. 3) Note redactions applied.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum artifacts for capstone?”
Knowledge Check
APPLY: Evidence pack is:
Multiple choice
Knowledge Check
APPLY: True or False: Production screenshots without scope belong in pack.
True or False
Knowledge Check
APPLY: Index should note:
Multiple choice