Incident › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on `$IR_LAB` — checklist, lab path, evidence pack sealed; zero payload refs.
Visual · t34_capstone_lab
Capstone: checklist × $IR_LAB literacy evidence. Original Cyberlium.
Opening
Close the Incident Response literacy loop — playbooks exercised, tabletop complete, PIR shipped — without payloads or unauthorized prod IR.
Walk Topic 34 checklist on YOUR `$IR_LAB`: verify RoE, lab path current, planning through PIR packs indexed, scan for payload refs and payment crime how-tos (must be zero). Update index with capstone UTC completion. Integrity paragraph: tabletop fictional discipline and payment ethics key insight from YOUR path. No ransomware payloads, no payment negotiation crime how-tos, no unauthorized prod IR, no unauthorized notifications, no stranger network containment. Optional mentor review — three clarity questions. Secure notes chmod 600 after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero payload refs in any file.
Scan sealed pack for unauthorized prod URLs — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA Stop Ransomware — https://www.cisa.gov/stopransomware FIRST — https://www.first.org/ ISO/IEC 27035 — https://www.iso.org/standard/78973.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
grep NEVER "$IR_LAB/notes/no-stranger-ir.txt"
grep -E 'HARD BAN|how-to' "$IR_LAB/scenarios/payment-ethics.txt" "$IR_LAB/scenarios/ransomware-named.txt"
echo '=== Capstone: policy → playbooks → tabletop LAB-IR-RANSOM-001 → containment tree → PIR ==='
grep -E 'FAKE|no payment' "$IR_LAB/scenarios/LAB-IR-RANSOM-001.md"
grep '\[ \]' "$IR_LAB/notes/capstone-checklist.txt" | head -5
python3 - <<'PY'
import os
lab = os.environ.get('IR_LAB', os.path.expanduser('~/cyberlium-lab/t34-ir'))
path = os.path.join(lab, 'notes', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'Incident Response Capstone',
'scope: YOUR $HOME/cyberlium-lab/t34-ir/ + tabletop scenarios only',
'planning: policy stub + severity matrix + RACI + PICERL checklist',
'playbooks: anatomy + hygiene + phishing response stub',
'detection: intake + analysis + evidence hygiene',
'containment: decision-tree.md + short/long options (authorized assets)',
'ransomware: LAB-IR-RANSOM-001 markdown — no malware, no payment how-to',
'comms: internal + external + executive templates',
'post-incident: PIR + IR report + lessons learned + detection gaps',
'never: ransomware builders / paying criminals how-to / stranger host isolation',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|LAB-IR-RANSOM' "$IR_LAB/notes/capstone-summary.txt"
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t34-ir/notes/no-stranger-ir.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t34-ir/notes/capstone-summary.txt | Select-String never Get-Content $HOME/cyberlium-lab/t34-ir/scenarios/LAB-IR-RANSOM-001.md | Select-String FAKE
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA Stop Ransomware (https://www.cisa.gov/stopransomware); FIRST (https://www.first.org/); ISO/IEC 27035 (https://www.iso.org/standard/78973.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
RoE + tabletop fictional + payment ethics key → professional handoff idea from YOUR lab path.
Name what breaks if you skip scope or author payloads — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 35 Purple Teaming on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero payload scan.
5. What you record before the next lesson
Capstone pack path. $IR_LAB quiet.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes ransomware payload walkthrough as bonus exhibit.
Right
Capstone complete on $IR_LAB with full teardown. Next: topic quiz.
Mission: Topic 34 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero payload refs. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Ransomware payload build earns capstone credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice