Incident › Module 10 › Lesson 1
Checklist
Topic 34 capstone checklist — IR mindset, planning, playbooks, detection, containment, eradication, ransomware tabletop, comms, PIR on `$IR_LAB`.
Visual · t34_capstone_checklist
Checklist consolidates Incident Response literacy pillars. $IR_LAB only. Original Cyberlium.
Opening
Capstone proves Incident Response literacy on YOUR authorized `$IR_LAB` work — not payload creation or unauthorized prod IR.
Assemble checklist covering Modules 1–9: IR mindset and lab scope, planning and severity, team and playbooks, detection and analysis, containment literacy, eradication and recovery, ransomware tabletop and payment ethics, comms and legal, post-incident PIR. Use on capstone walk of YOUR `$IR_LAB` — never ransomware payloads, never payment negotiation crime how-tos, never unauthorized prod IR or notifications, never stranger network containment. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab/t34-ir/. Integrity rows: `$IR_LAB` only, tabletop scenarios fictional, no payload how-tos, limitations documented.
1. Scope and ethics
$IR_LAB named with RoE reference. NEVER payload creation, NEVER payment crime how-tos, NEVER unauthorized prod IR, NEVER stranger network ops.
Ransomware module = tabletop defender literacy — not encryptor authoring.
Command guide
Try these commands — Scope and ethics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA Stop Ransomware — https://www.cisa.gov/stopransomware FIRST — https://www.first.org/ SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/notes/capstone-checklist.txt" <<'EOF'
[ ] lab.env + playbooks/ scenarios/ planning/ detection/ containment/ eradication/ comms/ post-incident/
[ ] roe.txt + no-stranger-ir.txt reviewed
[ ] IR policy stub + severity matrix + RACI + PICERL checklist
[ ] Playbook anatomy + runbook hygiene + phishing stub
[ ] Detection intake + analysis + evidence hygiene
[ ] Containment options + short/long + decision-tree.md
[ ] Eradication + recovery + validation checklist
[ ] LAB-IR-RANSOM-001 + tabletop flow + payment ethics (no how-to)
[ ] Comms templates: internal, external, executive brief
[ ] PIR + IR report + lessons learned + detection gaps
[ ] never: ransomware builders / paying criminals how-to / stranger host isolation
EOFCommand — copy this
grep '\[ \]' "$IR_LAB/notes/capstone-checklist.txt"
python3 -c "print('Capstone: Incident Response — YOUR t34-ir lab only')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA Stop Ransomware (https://www.cisa.gov/stopransomware); FIRST (https://www.first.org/); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
PICERL, playbooks, detection, containment, eradication, tabletop, comms, PIR — linked rows.
Cross-link Topic 33 Threat Intelligence as upstream context — separate authorized track.
3. Teardown
Notes secured chmod 600, evidence pack ready, lab stubs archived per brief.
Retention note for mentor handoff.
4. What you ship: Topic 34 capstone checklist
One-page Incident Response literacy capstone checklist for $IR_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'ransomware payload build for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Ransomware payload build required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice