Defensive › Module 10 › Lesson 3
Walkthrough
Narrate defender walk — checklist order on $LAB; what SOC would see if you skipped steps.
Visual · t16_walkthrough
Walkthrough = tell the story of YOUR defensive lab. Original Cyberlium.
Opening
A walkthrough is how you prove you can explain defense — not evade it.
Write walkthrough script: start RoE and $LAB inventory, hardening spot-check, pull local auth log sample, show central test line, cite policy/patch/change note, demonstrate backup restore pointer, awareness personal pledge. One paragraph: if you skipped central logging or restore test, what blind spots remain. Perform mentally or on $LAB — no live demo on unauthorized networks.
1. Walk order
RoE → hardening → local logs → central → policy/patch → backup → awareness.
Match checklist row to evidence index row.
Command guide
Try these commands — Walk order
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK browse — https://attack.mitre.org/ CIS Controls — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
Built-in (iproute2)
macOS: Use: netstat
Windows: Built-in (PowerShell: Invoke-WebRequest) Use: netstat
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://attack.mitre.org/techniques/enterprise/ -o /dev/null -w "ATT&CK techniques HTTP %{http_code}
"
ss -tulpn 2>/dev/null | head -10; journalctl -n 10 --no-pager 2>/dev/null | head -5Primary tools to practice this lesson: curl, ss, journalctl. Reference sites: MITRE ATT&CK browse (https://attack.mitre.org/); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender lens
What alerts would fire on missing patches or auth failures you documented.
Time sync mentioned before correlation claims.
3. Gap honesty
Mark N/A hardware honestly — gap is fix plan on YOUR bench, not stranger targets.
No filler with unauthorized scans.
4. What you ship: walkthrough script
Ordered narrative + blind-spot paragraph + defender alert mention.
5. What you record before the next lesson
Walkthrough script path.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Walkthrough includes 'then we scanned the dorm subnet.'
Right
Walkthrough script done. Next: capstone lab.
Mission: walkthrough draft
1) Write eight-step walk order. 2) One paragraph blind spots if steps skipped. 3) One defender alert example from your logs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Blind spot if no restore test?”
Knowledge Check
APPLY: Walkthrough order starts with:
Multiple choice
Knowledge Check
APPLY: True or False: Dorm subnet scan belongs in walkthrough.
True or False
Knowledge Check
APPLY: Blind-spot paragraph names:
Multiple choice