Evidence Pack

Bundle Topic 34 literacy evidence from `$IR_LAB` — planning, playbooks, detection, containment, eradication, tabletop, comms, PIR; no payload refs.

Evidence Pack• Audio Walkthrough

00:00/02:55

Visual · t34_evidence_pack

Evidence pack = mentor handoff from $IR_LAB literacy. Original Cyberlium.

One indexed pack beats scattered IR notes — and never includes ransomware payloads or payment crime how-tos.

Assemble evidence pack: `$IR_LAB` RoE, lab setup proof, planning and playbook labs if brief assigned, detection/containment/eradication labs, ransomware tabletop pack, comms lab, PIR lab, integrity statement (tabletop fictional only, no payload how-tos, no payment crime how-tos, no unauthorized prod access, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + tabletop stubs + diagrams, not payload guides. Gap paragraph for Topic 35 Purple Teaming — separate authorized track. Scan folder for payload refs, payment crime how-tos, prod keys, victim PII — zero tolerance.

1. Pack contents

Minimum: RoE, planning, playbooks, detection, containment, eradication, tabletop, comms, PIR, integrity index.

Optional: module labs per brief — no refused technique files.

Command guide

Try these commands — Pack contents

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final ISO/IEC 27035 — https://www.iso.org/standard/78973.html SANS IR — https://www.sans.org/for-organizations/incident-response/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
python3 - <<'PY'
import os
lab = os.environ.get('IR_LAB', os.path.expanduser('~/cyberlium-lab/t34-ir'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
  'CAPSTONE EVIDENCE INDEX — YOUR t34-ir lab only',
  'Ethics: roe.txt, no-stranger-ir.txt, payment-ethics.txt',
  'Planning: ir-policy-stub, severity-matrix, raci-matrix, picerl-checklist',
  'Playbooks: anatomy template, runbook hygiene, phishing stub',
  'Detection: intake form, analysis-named, evidence hygiene',
  'Containment: options, short-vs-long, decision-tree.md',
  'Eradication: eradication-named, recovery-named, validation checklist',
  'Ransomware tabletop: LAB-IR-RANSOM-001.md, tabletop-flow, payment ethics',
  'Comms: internal-status, external-notification, executive-brief templates',
  'Post-incident: PIR template, IR report, lessons learned, detection gaps',
  'Refusals: no ransomware builders / payment how-to / stranger isolation',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'LAB-IR-RANSOM|Refusals|decision-tree' "$IR_LAB/notes/capstone-evidence-index.txt"

Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Index fields

Artifact name, module lesson, path, UTC date, description, redactions applied.

Checklist row ↔ index row accountability.

3. Integrity

$IR_LAB only, tabletop fictional discipline, no payload refs, share-safe export.

Scan before seal — remove accidental prod keys or payment crime notes.

4. What you ship: Incident Response evidence pack

Bundled deliverables + index + integrity — chmod 600, report not payload guides default.

5. What you record before the next lesson

Evidence pack path.

6. Wrong vs right: stranger networks vs YOUR IR tabletop

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Evidence pack includes ransomware payload build guide and payment negotiation script.
Right: Evidence pack assembled. Next: Capstone Lab.

Hands-on Exercise