Roles RACI
Roles RACI literacy identifies incident commander, scribe, comms lead, and technical leads — assign RACI on YOUR $IR_LAB tabletop roster before live incident roles.
Visual · t34_roles_raci
Roles RACI literacy. $IR_LAB only. Original Cyberlium.
Clear roles beat heroics — literacy names IR RACI so tabletops train coordinated response on fictional org charts you document.
IR roles include incident commander (IC) who owns decisions, scribe who logs timeline, comms lead who handles stakeholders, technical leads for forensics/network/identity, and legal liaison when required. RACI assigns Responsible, Accountable, Consulted, Informed per task — one Accountable per decision. Cyberlium maps RACI on YOUR $IR_LAB — assign roles for three fictional tabletop tasks. Next: Planning Lab.
1. IR roles and RACI (named)
Incident Commander: single decision authority during active incident. Scribe: chronological log, action items, evidence references. Comms Lead: internal and external messaging per policy. Technical Lead: containment and analysis execution on YOUR org assets.
On $IR_LAB, write RACI row — task, Responsible, Accountable, Consulted, Informed for one tabletop inject.
Command guide
Try these commands — IR roles and RACI (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why RACI literacy prevents duplicate command and gaps
Two ICs issuing conflicting containment orders delay response. Missing scribe loses evidence for post-incident review. RACI on paper clarifies who decides vs who executes before stress hits.
Students assign lab roles on notes — production RACI follows org chart and on-call rotation.
3. Lab boundary
Forbidden: assigning yourself IC over stranger org incidents without authorization. Allowed: roles RACI card — four roles with $IR_LAB fictional assignments for tabletop tasks.
Ship: roles RACI card for YOUR lab roster. Next: Planning Lab.
4. What you ship: roles RACI card for $IR_LAB
Four roles with RACI rows for tabletop tasks. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Roles RACI card. $IR_LAB named. File t34-m02-l03-roles-raci.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run tabletop with no IC and no scribe. Claim IC authority over stranger networks.
- Right: Write roles RACI card for YOUR $IR_LAB. Next: Planning Lab.
Mission: assign RACI on YOUR lab tabletop
1) Define IC, scribe, comms, technical lead in one sentence each. 2) Write RACI for three tabletop tasks. 3) Confirm one Accountable per task. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One IC — many contributors. RACI on paper saves arguments under pressure.
APPLY: Incident Commander primarily:
APPLY: True or False: RACI assigns one Accountable party per decision or task.
APPLY: Roles RACI literacy on Cyberlium uses: