Incident › Module 4 › Lesson 4
Lab — Detection
Pack detection intake, analysis named, and evidence hygiene cards — detection file from $IR_LAB only.
Visual · t34_detection_lab
Lab: detection pack. $IR_LAB only. Original Cyberlium.
Opening
Detection pack merges intake to analysis to evidence — paperwork before containment module.
Lessons 4-1–4-3 named detection intake, analysis steps, and evidence hygiene. This lab merges three sections into one $IR_LAB detection artifact with M1 ethics and M3 playbook cross-references. No stranger-network forensics or live victim exports — detection paperwork only. Next: Quiz — Detection and Analysis.
1. Lab contract: detection and analysis pack
Create $HOME/cyberlium-lab/t34-m04-l04-detection-lab.txt merging intake, analysis, and evidence hygiene sections with $IR_LAB fictional alert chain and M1/M3 cross-references.
Optional: link intake alert to playbook trigger from M3 pack.
Command guide
Try these commands — Lab contract: detection and analysis pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA — https://www.cisa.gov/stopransomware FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/detection/detection-lab-summary.md" <<'EOF'
# Detection & Analysis Lab Summary — YOUR lab
- intake-form-template.md: structured incident intake
- analysis-named.txt: timeline, scope, root cause literacy
- evidence-hygiene-checklist.md: chain of custody + authorized scope
## Exercise
- Draft timeline bullets for fictional LAB-IR-RANSOM-001
## Refusals
- No malware execution; no stranger host forensics
EOFCommand — copy this
grep -E 'Exercise|Refusals|intake-form' "$IR_LAB/detection/detection-lab-summary.md" ls "$IR_LAB/detection/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t34-ir/detection/evidence-hygiene-checklist.md | Select-String unauthorized
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA (https://www.cisa.gov/stopransomware); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for live victim PII, stranger-network asset refs, ransomware payload steps — remove. Confirm all evidence is $IR_LAB fictional.
Custody rows use placeholder hashes — no real victim disk images.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Containment Options.
Detection literacy feeds containment lessons in M5.
4. What you ship: detection and analysis pack for $IR_LAB
Merged intake, analysis, evidence sections. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Detection pack path. $IR_LAB named. File t34-m04-l04-detection-lab.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include live victim alert export. Skip evidence custody section.
Right
Write YOUR detection pack for $IR_LAB. chmod 600. Next: Quiz — Detection and Analysis.
Mission: freeze YOUR detection pack on disk
1) Merge M4 literacy sections. 2) Confirm fictional evidence only. 3) Link M1/M3 cross-refs. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed detection pack beats ten unlabeled alert screenshots.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Detection pack should include evidence custody rows.
True or False
Knowledge Check
APPLY: Detection pack supports:
Multiple choice