Incident › Module 9 › Lesson 4
Lab — PIR
Post-incident review lab on `$IR_LAB` — lessons learned, IR report outline, detection gap register bundled.
Visual · t34_pir_lab
Lab: PIR pack on YOUR $IR_LAB tabletop. Original Cyberlium.
Opening
Ship post-incident artifacts from YOUR tabletop — lessons, report outline, detection gaps — zero prod case paste or unauthorized rule deploy.
On YOUR `$IR_LAB` per brief: (1) scope proof — full tabletop thread Modules 5–8 labeled; (2) lessons learned preview Module 9-1; (3) IR report outline Module 9-2; (4) detection gap register Module 9-3; (5) PIR meeting agenda stub (attendees, hotwash questions, action item template); (6) integrity — `$IR_LAB` only, no prod case PII, no unauthorized prod changes, blameless process; (7) chmod 600 pack. Cross-link entire Topic 34 thread — professional PIR literacy handoff.
1. Lab deliverables
Lessons + report + gaps + PIR agenda cross-indexed — single post-incident thread.
Action items link gap register to owner stubs from lessons learned.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final ISO/IEC 27035 — https://www.iso.org/standard/78973.html SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/post-incident/pir-template.md" <<'EOF'
# Post-Incident Review (PIR) — YOUR template
**Incident ID:** LAB-IR-RANSOM-001
**Date:** [UTC]
**Facilitator:** IR Lead
**Attendees:** SOC, IT Ops, Legal, Comms, Exec sponsor (fictional names OK)
## Agenda
1. Timeline walkthrough (ir-report-template.md)
2. Decision review: containment, comms, recovery
3. Detection gaps (detection-gaps-checklist.md)
4. Lessons learned (lessons-learned-template.md)
5. Action item assignment with owners and dates
## Outcomes
- Playbook updates required: [list]
- Training needs: [list]
- Budget/tooling requests: [list]
## Sign-off
IR Lead: ______ | Date: ______
Tabletop PIR for lab training — no real victim data
EOFCommand — copy this
grep -E 'LAB-IR-RANSOM|Action item|Tabletop' "$IR_LAB/post-incident/pir-template.md" ls "$IR_LAB/post-incident/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t34-ir/post-incident/pir-template.md | Select-String PIR
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Limitations paragraph present in report outline — not optional.
Blameless language throughout — process and system gaps only.
3. Teardown
Secure notes chmod 600; PIR pack ready for capstone evidence index.
Archive stub optional per brief.
4. What you ship: PIR lab pack
Lessons + report outline + gap register + PIR agenda + integrity — chmod 600.
5. What you record before the next lesson
PIR lab pack path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
PIR lab includes prod incident ticket paste with customer PII as primary source.
Right
PIR lab pack on `$IR_LAB` tabletop. Next: quiz.
Mission: PIR lab
1) Scope and full thread proof. 2) Lessons learned and report outline. 3) Detection gap register. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “PIR agenda — minimum hotwash questions?”
Knowledge Check
APPLY: PIR lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Blame theater belongs in PIR lab.
True or False
Knowledge Check
APPLY: PIR lab pack should:
Multiple choice