Incident › Module 4 › Lesson 2
Analysis Named
Analysis named literacy covers hypothesis testing, timeline building, scope assessment, and ATT&CK mapping — analyze fictional tabletop evidence on YOUR $IR_LAB.
Visual · t34_analysis_named
Analysis literacy. $IR_LAB only. Original Cyberlium.
Opening
Triage is not conclusion — literacy names analysis steps so tabletop investigations stay evidence-driven on scenarios you own.
IR analysis forms hypotheses — 'phish led to credential theft' — then tests with logs, disk images, and memory captures on YOUR org assets. Timeline building orders events UTC. Scope assessment asks what assets and data are affected. ATT&CK mapping labels behaviors for detection gaps — all on authorized evidence. Cyberlium practices analysis on YOUR $IR_LAB — write hypothesis, three timeline events, and one ATT&CK ID for fictional inject. Next: Evidence Hygiene.
1. Analysis steps (named)
Hypothesis: working theory stated explicitly and falsifiable. Timeline: ordered events with UTC timestamps and evidence refs. Scope: affected hosts, accounts, data classes. ATT&CK map: technique IDs supported by lab evidence — not guesswork.
On $IR_LAB, write analysis card — hypothesis, three timeline bullets, one technique ID for fictional phishing-to-execution chain.
Command guide
Try these commands — Analysis steps (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final SANS IR — https://www.sans.org/for-organizations/incident-response/ FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/detection/analysis-named.txt" <<'EOF'
IR analysis techniques — NAMED LITERACY:
Timeline analysis: correlate logs by UTC — auth, DNS, proxy, EDR
Scope assessment: which hosts/users/data touched?
Root cause hypothesis: initial access vector (phish, vuln, cred theft)
Impact assessment: confidentiality / integrity / availability
Attribution caution: TTP overlap ≠ confirmed actor — document confidence
Diamond Model: adversary, capability, infrastructure, victim (YOUR notes)
Tabletop: analyze LAB-IR-RANSOM-001 markdown — no malware execution
EOFCommand — copy this
grep -E 'Timeline|Scope|Root cause|Diamond' "$IR_LAB/detection/analysis-named.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS IR (https://www.sans.org/for-organizations/incident-response/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why named analysis prevents premature containment
Isolating wrong host spreads panic and loses monitoring on true ground zero. Weak hypotheses waste forensics hours. Documented timelines survive shift handoffs.
Students analyze lab evidence on notes — production analysis follows chain-of-custody and legal hold rules.
3. Lab boundary
Forbidden: analysis conclusions on stranger networks or live victim data without authorization. Allowed: analysis named card — hypothesis, timeline, ATT&CK row on $IR_LAB fictional evidence.
Ship: analysis named card for YOUR lab investigation. Next: Evidence Hygiene.
4. What you ship: analysis named card for $IR_LAB
Hypothesis, timeline, scope, ATT&CK row. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Analysis card. $IR_LAB named. File t34-m04-l02-analysis-named.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Declare scope without evidence. Map ATT&CK techniques not supported by lab logs.
Right
Write analysis named card for YOUR $IR_LAB. Next: Evidence Hygiene.
Mission: analyze fictional evidence on YOUR lab
1) State one falsifiable hypothesis. 2) Build three-event UTC timeline. 3) Map one ATT&CK ID with evidence note. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Hypothesis first, conclusion second — analysis is iterative, not instant.
Knowledge Check
APPLY: IR analysis hypothesis should be:
Multiple choice
Knowledge Check
APPLY: True or False: Timeline events should use UTC timestamps.
True or False
Knowledge Check
APPLY: Analysis named literacy on Cyberlium uses:
Multiple choice