Incident › Module 9 › Lesson 1
Lessons Learned
Lessons learned literacy — hotwash, root cause themes, process gaps, detection uplift — PIR preview rows on YOUR `$IR_LAB` tabletop.
Visual · t34_lessons_learned
Lessons learned = named PIR preview rows. $IR_LAB. Original Cyberlium.
Opening
Incidents teach if you capture lessons — name hotwash and gap rows on YOUR lab tabletop before skipping post-incident review.
Lessons learned literacy names: hotwash timing category (within days literacy stub), root cause theme category (people/process/technology literacy), process gap row category, detection/control uplift category, and ownership assignment for fixes category. Analyst documents lessons learned preview on `$IR_LAB` ransomware tabletop — five gap rows with suggested owner stub and priority — without blame-focused personal attacks, without hiding executive decision gaps, without prod change tickets from unauthorized lab notes. Cyberlium teaches PICERL Lessons Learned phase vocabulary — YOUR notes. Refused: blame theater, skipping PIR, unauthorized prod remediation from lab. Lab row: lessons learned preview (five gaps, owner stub, priority).
1. Named lessons rows
Hotwash timing, root cause themes, process gaps, detection uplift, fix ownership — five literacy anchors.
Blameless process focus — document system gaps, not personal attacks.
Command guide
Try these commands — Named lessons rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final ISO/IEC 27035 — https://www.iso.org/standard/78973.html SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/post-incident/lessons-learned-template.md" <<'EOF'
# Lessons Learned — YOUR template
## Incident summary
[Reference incident card ID; timeline; severity]
## What went well
- Detection speed; playbook clarity; comms timeliness
## What did not go well
- Gaps in backup testing; delayed escalation; tooling friction
## Root cause (confirmed or probable)
[Initial access vector; contributing factors]
## Action items
| ID | Action | Owner | Due date |
|----|--------|-------|----------|
| 1 | Update decision-tree.md | IR Lead | +30d |
| 2 | Backup restore drill | IT Ops | +60d |
Schedule review meeting within 14 days of incident close
EOFCommand — copy this
grep -E 'Action items|Root cause|14 days' "$IR_LAB/post-incident/lessons-learned-template.md"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. PIR preview
Link Module 7 tabletop hotwash stub — same incident thread UTC.
Priority row separates quick wins from structural fixes literacy.
3. Refused
No blame theater; no skipping PIR; no unauthorized prod changes from lab gaps.
Lessons literacy supports improvement — not scapegoating.
4. What you ship: lessons learned preview
Five gap rows + owner stub + priority + NEVER blame theater line.
5. What you record before the next lesson
Lessons learned preview path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write lessons learned doc naming and shaming coworkers from tabletop exercise.
Right
Lessons learned preview from `$IR_LAB` tabletop stub. Next: IR Reports.
Mission: lessons learned preview
1) Name five lessons learned rows. 2) Five gap rows from tabletop. 3) Owner stub and priority per gap. 4) Write NEVER blame theater line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Quick win vs structural fix — literacy split?”
Knowledge Check
APPLY: Lessons learned literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Blame theater belongs in lessons learned.
True or False
Knowledge Check
APPLY: Lessons learned includes:
Multiple choice