Incident › Module 1 › Lesson 4
Lab — Setup
Pack IR scope, lab scenario inventory, and ethics card — lab setup file only, dest $IR_LAB.
Visual · t34_lab_setup
Lab: write IR setup pack. $IR_LAB only. Original Cyberlium.
Opening
Lab setup before tabletop drills — scope paperwork IR mentors expect.
Lessons 1–3 defined why IR matters, lab scenarios only, and stranger-IR refusal. This lab ships the combined artifact: topic scope paragraph, lab scenario inventory row, and ethics card for $IR_LAB under $HOME/cyberlium-lab/t34-ir/. No ransomware payloads or stranger-network work required — scope and scenario paperwork first. Next: Quiz — IR Mindset and Lab.
1. Lab contract: write the setup pack
Create $HOME/cyberlium-lab/t34-m01-l04-lab-setup.txt with date, operator, $IR_LAB placeholder, literacy vs unauthorized IR action paragraph, lab scenario inventory row, and ethics card.
Optional: one-line proof your t34-ir folder exists — still no ransomware payload or stranger-network work required in this lab.
Command guide
Try these commands — Lab contract: write the setup pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final SANS IR — https://www.sans.org/for-organizations/incident-response/ ISO/IEC 27035 — https://www.iso.org/standard/78973.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/roe.txt" <<'EOF'
IR_LAB=$HOME/cyberlium-lab/t34-ir
targets: YOUR playbooks, YOUR scenarios, YOUR markdown templates in lab folder
never: ransomware builders; paying criminals how-to; live isolation of stranger hosts
never: deploy malware samples; probe unauthorized infrastructure
allowed: playbooks/, scenarios/; policy stub; severity matrix; RACI; PICERL checklist
allowed: FAKE incident card LAB-IR-RANSOM-001; containment decision tree; comms/PIR templates
output: tabletop notes, IR policy drafts, post-incident reports in lab folder
EOFCommand — copy this
chmod 600 "$IR_LAB/roe.txt" grep -E 'IR_LAB|never|allowed|YOUR' "$IR_LAB/roe.txt" ls -la "$IR_LAB/playbooks" "$IR_LAB/scenarios"
═══ WINDOWS ═══
Run on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t34-ir/roe.txt | Select-String never Get-ChildItem $HOME/cyberlium-lab/t34-ir/playbooks, $HOME/cyberlium-lab/t34-ir/scenarios
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS IR (https://www.sans.org/for-organizations/incident-response/); ISO/IEC 27035 (https://www.iso.org/standard/78973.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for 'ransomware payload,' stranger-network isolation steps, live victim IR dumps — redact or delete. Rewrite forum habits to $IR_LAB placeholders before you copy workflows.
Classmates build their own setup packs for their $IR_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then Policy Procedures.
IR mentors archive lab setup before first tabletop drill; you are practicing that habit early.
4. What you ship: IR lab setup pack for $IR_LAB
Setup pack: scope, scenario row, ethics card. $IR_LAB named. NEVER ransomware payloads. chmod 600.
5. What you record before the next lesson
Date. Setup pack path. $IR_LAB scope note. File t34-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and import live victim IR timeline. Add stranger-network isolation to approved list.
Right
Write YOUR lab setup pack for $IR_LAB. chmod 600. Next: Quiz — IR Mindset and Lab.
Mission: freeze YOUR IR lab setup pack on disk
1) Merge scope, scenario inventory, ethics sections. 2) Name $IR_LAB. 3) chmod 600. Never list stranger-network isolation as approved practice.
Stuck? Ask Cyberlium AI Mentor
Setup packs are boring on purpose — boring keeps IR work defensible.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on IR lab notes.
True or False
Knowledge Check
APPLY: A tutorial isolates stranger networks without scope. You:
Multiple choice