Incident › Module 3 › Lesson 3
Runbook Hygiene
Runbook hygiene literacy covers version control, test cadence, owner assignment, and stale-step removal — maintain runbooks on YOUR $IR_LAB tool placeholders.
Visual · t34_runbook_hygiene
Runbook hygiene literacy. $IR_LAB only. Original Cyberlium.
Opening
Stale runbooks kill incidents — literacy teaches hygiene habits so tabletop tool steps stay accurate on lab placeholders you govern.
Runbooks are tool-specific procedure steps — isolate host in EDR, disable account in IdP, block domain on firewall. Hygiene means version numbers, last-tested date, named owner, and removal of deprecated CLI flags. Untested runbooks fail when adrenaline hits. Cyberlium writes runbook hygiene checklist on YOUR $IR_LAB — one fictional EDR isolate step with version and owner fields. Next: Playbooks Lab.
1. Runbook hygiene fields (named)
Version and date: v1.3 tested 2026-01-15. Owner: team or role responsible for updates. Prerequisites: ticket ID, IC approval, evidence snapshot. Steps: numbered actions on YOUR org assets. Rollback: how to undo if containment causes outage.
On $IR_LAB, write runbook row — tool placeholder, version, owner, last-tested date for fictional isolate step.
Command guide
Try these commands — Runbook hygiene fields (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final ISO/IEC 27035 — https://www.iso.org/standard/78973.html FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/playbooks/runbook-hygiene-checklist.md" <<'EOF'
# Runbook / Playbook Hygiene — YOUR maintenance checklist
- [ ] Reviewed quarterly or after every Sev-2+ incident
- [ ] Version controlled with change log
- [ ] Contact list validated (no stale phone/email)
- [ ] Tool commands tested on lab VM — not copy-pasted to prod blindly
- [ ] Decision trees match current network diagram (YOUR org)
- [ ] Comms templates pre-approved by legal/comms
- [ ] Tabletop exercise documented annually
- [ ] No offensive steps against stranger infrastructure
EOFCommand — copy this
grep '\[ \]' "$IR_LAB/playbooks/runbook-hygiene-checklist.md"
python3 -c "print('Runbook hygiene: version control + quarterly review + tabletop validation')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why hygiene prevents incident-time surprises
Deprecated API steps waste minutes during P1. Missing rollback causes self-inflicted outages. Quarterly tabletop tests expose stale runbooks before production need.
Students document lab runbook metadata on notes — production runbooks follow ITSM and change windows.
3. Lab boundary
Forbidden: runbook steps targeting stranger SaaS tenants or deploying destructive payloads. Allowed: runbook hygiene card — metadata fields with $IR_LAB fictional tool placeholders.
Ship: runbook hygiene card for YOUR lab tools. Next: Playbooks Lab.
4. What you ship: runbook hygiene card for $IR_LAB
Version, owner, test date, rollback note. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Runbook hygiene card. $IR_LAB named. File t34-m03-l03-runbook-hygiene.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Copy production runbook with real credentials into lab. Skip version and owner fields.
Right
Write runbook hygiene card for YOUR $IR_LAB. Next: Playbooks Lab.
Mission: document runbook hygiene on YOUR lab
1) List five hygiene fields. 2) Write one fictional EDR isolate runbook row. 3) Add rollback sentence. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Last-tested date is a promise — tabletop the runbook or mark it untested.
Knowledge Check
APPLY: Runbook hygiene primarily ensures:
Multiple choice
Knowledge Check
APPLY: True or False: Runbooks should include rollback steps.
True or False
Knowledge Check
APPLY: Runbook hygiene literacy on Cyberlium uses:
Multiple choice