Incident › Module 10 › Lesson 2
Lab Path
Incident Response literacy path on `$IR_LAB` — lab setup to mentor handoff with ethics gates at every station.
Visual · t34_lab_path
Lab path = visual IR chain on YOUR $IR_LAB. Original Cyberlium.
Opening
Draw the path from lab scope to mentor handoff — with stop signs at every payload shortcut and unauthorized prod IR lane.
Document literacy path: `$IR_LAB` setup → planning → playbooks → detection → containment → eradication/recovery → ransomware tabletop → comms/legal → PIR → capstone. Ethics gates: ransomware payloads, payment negotiation crime how-tos, unauthorized prod IR, unauthorized customer/regulator notifications, stranger network containment — refused paths labeled red. UTC milestones and artifact IDs per station. Mermaid or sketch chmod 600. Honest N/A if brief skipped live lab host — labeled. Defender breakpoint: where RoE or scope discipline prevented out-of-scope IR action.
1. Path stations
Setup, planning, playbooks, detection, containment, eradication, tabletop, comms, PIR, handoff — ten minimum stations.
Each station links evidence index row and module lesson ID.
Command guide
Try these commands — Path stations
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA ransomware guide — https://www.cisa.gov/stopransomware/ransomware-guide FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
echo '=== Capstone path: mindset → planning → playbooks → detection → containment → eradication → ransomware tabletop → comms → PIR ==='
grep -E 'ir-policy|severity|raci|picerl' "$IR_LAB/planning/"* 2>/dev/null | head -4
grep -E 'LAB-IR-RANSOM|decision-tree' "$IR_LAB/scenarios/LAB-IR-RANSOM-001.md" "$IR_LAB/containment/decision-tree.md" | head -4
curl -sS https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final | head -5
curl -sS https://www.cisa.gov/stopransomware/ransomware-guide | head -5Primary tools to practice this lesson: curl, grep. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics overlay
Red stops: payload creation, payment crime how-tos, unauthorized prod IR, unauthorized notifications, stranger network ops.
RoE branch always green start — `$IR_LAB` on separate labeled branch.
3. Integrity breakpoint
Mark where scope check prevented out-of-RoE IR or prod access.
One paragraph uplift from YOUR `$IR_LAB` path.
4. What you ship: lab path diagram
IR chain with ethics gates + UTC milestones — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Lab path includes ransomware payload build shortcut lane.
Right
Lab path documented for $IR_LAB. Next: Evidence Pack.
Mission: lab path diagram
1) Map ten stations. 2) Add six ethics gates. 3) UTC milestones per station. 4) Link evidence index IDs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
Knowledge Check
APPLY: Lab path documents:
Multiple choice
Knowledge Check
APPLY: True or False: Payment crime how-to shortcut OK on path.
True or False
Knowledge Check
APPLY: Path ends at:
Multiple choice