Incident › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 34 literacy evidence from `$IR_LAB` — planning, playbooks, detection, containment, eradication, tabletop, comms, PIR; no payload refs.
Visual · t34_evidence_pack
Evidence pack = mentor handoff from $IR_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered IR notes — and never includes ransomware payloads or payment crime how-tos.
Assemble evidence pack: `$IR_LAB` RoE, lab setup proof, planning and playbook labs if brief assigned, detection/containment/eradication labs, ransomware tabletop pack, comms lab, PIR lab, integrity statement (tabletop fictional only, no payload how-tos, no payment crime how-tos, no unauthorized prod access, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + tabletop stubs + diagrams, not payload guides. Gap paragraph for Topic 35 Purple Teaming — separate authorized track. Scan folder for payload refs, payment crime how-tos, prod keys, victim PII — zero tolerance.
1. Pack contents
Minimum: RoE, planning, playbooks, detection, containment, eradication, tabletop, comms, PIR, integrity index.
Optional: module labs per brief — no refused technique files.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final ISO/IEC 27035 — https://www.iso.org/standard/78973.html SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
python3 - <<'PY'
import os
lab = os.environ.get('IR_LAB', os.path.expanduser('~/cyberlium-lab/t34-ir'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR t34-ir lab only',
'Ethics: roe.txt, no-stranger-ir.txt, payment-ethics.txt',
'Planning: ir-policy-stub, severity-matrix, raci-matrix, picerl-checklist',
'Playbooks: anatomy template, runbook hygiene, phishing stub',
'Detection: intake form, analysis-named, evidence hygiene',
'Containment: options, short-vs-long, decision-tree.md',
'Eradication: eradication-named, recovery-named, validation checklist',
'Ransomware tabletop: LAB-IR-RANSOM-001.md, tabletop-flow, payment ethics',
'Comms: internal-status, external-notification, executive-brief templates',
'Post-incident: PIR template, IR report, lessons learned, detection gaps',
'Refusals: no ransomware builders / payment how-to / stranger isolation',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'LAB-IR-RANSOM|Refusals|decision-tree' "$IR_LAB/notes/capstone-evidence-index.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$IR_LAB only, tabletop fictional discipline, no payload refs, share-safe export.
Scan before seal — remove accidental prod keys or payment crime notes.
4. What you ship: Incident Response evidence pack
Bundled deliverables + index + integrity — chmod 600, report not payload guides default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes ransomware payload build guide and payment negotiation script.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle planning through PIR index. 2) Integrity statements. 3) Confirm zero payload refs. 4) Gap note for Topic 35 Purple Teaming.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Ransomware payload guides OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice