Decision Trees

Decision trees literacy maps if-then containment branches — author decision tree on YOUR $IR_LAB scenarios with IC escalation nodes.

Decision Trees• Audio Walkthrough

00:00/03:24

Visual · t34_decision_trees

Decision tree literacy. $IR_LAB only. Original Cyberlium.

Branches beat guesswork — literacy teaches containment decision trees so tabletop paths stay consistent when signals change.

Containment decision trees start with confirmed indicators — e.g., 'lateral movement observed?' If yes, escalate to IC and isolate segment on YOUR org network. If no, continue monitoring with enhanced logging. Branches include rollback nodes — if isolate causes clinical system outage, IC chooses alternate path. Cyberlium draws decision tree on YOUR $IR_LAB — three nodes with yes/no branches for fictional phishing inject. Next: Containment Lab.

1. Decision tree nodes (named)

Root question: observable condition from analysis — credential use from unusual geo. Branch actions: monitor, contain host, disable account, escalate IC. Terminal nodes: scribe logs decision, ticket updated, comms hook if P1. Rollback diamond: business impact exceeds threshold — IC selects alternate.

On $IR_LAB, sketch tree — root question, two branches, one IC escalation node for fictional scenario.

Command guide

Try these commands — Decision tree nodes (named)

═══ LINUX / BASH (SOC Analyst Triage) ═══

Filter system logs for security-relevant warnings and errors

Command — copy this

journalctl -p 3 -xb --no-pager | head -20

Search for suspicious persistent cron entries or service changes

Command — copy this

ls -lat /etc/cron.* /etc/systemd/system/ | head -15

═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -Wrap

Check open listening network connections with process owners

Command — copy this

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why trees reduce inconsistent containment

Ad-hoc decisions vary by analyst shift. Trees encode policy into repeatable branches tested in tabletops. Update tree when post-incident review finds gap.

Students draw lab trees on notes — production trees align with playbooks and legal guidance.

3. Lab boundary

Forbidden: tree branches that isolate stranger networks or deploy payloads. Allowed: decision tree card — three nodes on $IR_LAB YOUR org scenario.

Ship: decision tree card for YOUR lab scenario. Next: Containment Lab.

4. What you ship: decision tree card for $IR_LAB

Root, branches, IC node, rollback note. $IR_LAB named. chmod 600.

5. What you record before the next lesson

Date. Decision tree card. $IR_LAB named. File t34-m05-l03-decision-trees.txt chmod 600.

6. Wrong vs right: stranger networks vs YOUR IR tabletop

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Draw tree with no IC escalation path. Add stranger-network isolate branch.
Right: Write decision tree card for YOUR $IR_LAB. Next: Containment Lab.

Hands-on Exercise