Incident › Module 3 › Lesson 1
IR Team
IR team literacy names core, extended, and external team members — map roster and on-call on YOUR $IR_LAB before live incident activation.
Visual · t34_ir_team
IR team literacy. $IR_LAB only. Original Cyberlium.
Opening
Incidents need a bench — literacy teaches IR team structure so tabletops assign the right skills on fictional rosters you document.
Core IR team includes SOC, IR coordinators, IT ops, and security engineering. Extended team adds legal, HR, PR, and executive sponsors. External partners may include MSSP, forensics retainers, and law enforcement — under contract and scope. Literacy names who sits at the table before the inject fires. Cyberlium maps IR team roster on YOUR $IR_LAB — list core and extended roles for one fictional org. Next: Playbook Anatomy.
1. IR team tiers (named)
Core: 24/7 SOC, IR lead, network and identity admins, backup owners. Extended: legal counsel, HR for insider cases, PR for breach comms, business unit liaisons. External: MSSP, IR retainer firm, cyber insurance — invoked per contract.
On $IR_LAB, write roster row — role, team tier, fictional contact placeholder for tabletop org CYBERLIUM-LAB.
Command guide
Try these commands — IR team tiers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST CSIRT services — https://www.first.org/standards/frameworks/csirts SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/notes/ir-team-named.txt" <<'EOF'
IR team roles — NAMED LITERACY:
IR Lead / Incident Commander: scope, decisions, stakeholder sync
SOC analysts: detection, triage, log analysis, initial timeline
Forensics: disk/memory capture on AUTHORIZED hosts only
IT Ops: containment execution, rebuild, patch deployment
Legal: breach notification, regulatory, preserve privilege
Comms/PR: internal + external messaging templates
Executive sponsor: resource approval, business continuity calls
Lab: map roles to RACI matrix — fictional tabletop org
EOFCommand — copy this
grep -E 'IR Lead|SOC|Forensics|Legal' "$IR_LAB/notes/ir-team-named.txt" curl -sS https://www.first.org/standards/frameworks/csirts | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST CSIRT services (https://www.first.org/standards/frameworks/csirts); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why team literacy prevents skill gaps mid-incident
Missing legal early delays notification decisions. No backup owner blocks recovery actions. Tabletops surface roster gaps before production stress.
Students map lab rosters on notes — production activation follows org on-call and vendor contracts.
3. Lab boundary
Forbidden: paging real law enforcement or vendor IR for personal lab without contract. Allowed: IR team card — core and extended roster with $IR_LAB fictional placeholders.
Ship: IR team card for YOUR lab org. Next: Playbook Anatomy.
4. What you ship: IR team card for $IR_LAB
Core and extended roster with fictional contacts. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. IR team card. $IR_LAB named. File t34-m03-l01-ir-team.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run tabletop with empty roster. Call real MSSP for personal lab without scope.
Right
Write IR team card for YOUR $IR_LAB. Next: Playbook Anatomy.
Mission: map IR team on YOUR lab org
1) List three core and three extended roles. 2) Note when external partners activate. 3) Use fictional contact placeholders only. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Legal and PR belong on extended roster — tabletop them early, not after headlines.
Knowledge Check
APPLY: Core IR team typically includes:
Multiple choice
Knowledge Check
APPLY: True or False: Extended team may include legal, HR, and PR.
True or False
Knowledge Check
APPLY: IR team literacy on Cyberlium uses:
Multiple choice