Incident › Module 5 › Lesson 3
Decision Trees
Decision trees literacy maps if-then containment branches — author decision tree on YOUR $IR_LAB scenarios with IC escalation nodes.
Visual · t34_decision_trees
Decision tree literacy. $IR_LAB only. Original Cyberlium.
Opening
Branches beat guesswork — literacy teaches containment decision trees so tabletop paths stay consistent when signals change.
Containment decision trees start with confirmed indicators — e.g., 'lateral movement observed?' If yes, escalate to IC and isolate segment on YOUR org network. If no, continue monitoring with enhanced logging. Branches include rollback nodes — if isolate causes clinical system outage, IC chooses alternate path. Cyberlium draws decision tree on YOUR $IR_LAB — three nodes with yes/no branches for fictional phishing inject. Next: Containment Lab.
1. Decision tree nodes (named)
Root question: observable condition from analysis — credential use from unusual geo. Branch actions: monitor, contain host, disable account, escalate IC. Terminal nodes: scribe logs decision, ticket updated, comms hook if P1. Rollback diamond: business impact exceeds threshold — IC selects alternate.
On $IR_LAB, sketch tree — root question, two branches, one IC escalation node for fictional scenario.
Command guide
Try these commands — Decision tree nodes (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA ransomware guide — https://www.cisa.gov/stopransomware/ransomware-guide SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/containment/decision-tree.md" <<'EOF'
# Containment Decision Tree — YOUR tabletop (markdown)
```
Incident detected?
├─ No → monitor / close ticket
└─ Yes → Classify severity (severity-matrix.md)
├─ Sev 4 → standard playbook; document
├─ Sev 3 → short-term: isolate single host (YOUR VLAN)
└─ Sev 1-2 → activate IR lead + legal
├─ Active ransomware?
│ ├─ Yes → isolate segment; preserve logs; NO payment how-to
│ └─ No → scope assessment branch
├─ Data exfil suspected?
│ └─ Block egress; legal notify; preserve evidence
└─ Containment authorized on YOUR assets only
```
NEVER: ransomware builders; paying criminals how-to; stranger host isolation
EOFCommand — copy this
grep -E 'Sev|ransomware|NEVER|YOUR assets' "$IR_LAB/containment/decision-tree.md"
python3 -c "print('Decision tree: severity-driven containment — tabletop markdown only')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why trees reduce inconsistent containment
Ad-hoc decisions vary by analyst shift. Trees encode policy into repeatable branches tested in tabletops. Update tree when post-incident review finds gap.
Students draw lab trees on notes — production trees align with playbooks and legal guidance.
3. Lab boundary
Forbidden: tree branches that isolate stranger networks or deploy payloads. Allowed: decision tree card — three nodes on $IR_LAB YOUR org scenario.
Ship: decision tree card for YOUR lab scenario. Next: Containment Lab.
4. What you ship: decision tree card for $IR_LAB
Root, branches, IC node, rollback note. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Decision tree card. $IR_LAB named. File t34-m05-l03-decision-trees.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draw tree with no IC escalation path. Add stranger-network isolate branch.
Right
Write decision tree card for YOUR $IR_LAB. Next: Containment Lab.
Mission: draw containment tree on YOUR lab
1) Write root question from fictional analysis. 2) Add yes/no branches with actions. 3) Mark IC escalation and rollback node. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Every tree needs an IC node — containment without command is chaos.
Knowledge Check
APPLY: Containment decision trees primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Rollback nodes address business impact from containment actions.
True or False
Knowledge Check
APPLY: Decision tree literacy on Cyberlium uses:
Multiple choice