Purple › Module 10 › Lesson 1
Checklist
Topic 35 capstone checklist — purple mindset, detection engineering, sigma/SIEM, testing, atomic sim, exercise design, coverage, findings on `$PURPLE_LAB`.
Visual · t35_capstone_checklist
Checklist consolidates Purple Teaming literacy pillars. $PURPLE_LAB only. Original Cyberlium.
Opening
Capstone proves Purple Teaming literacy on YOUR authorized `$PURPLE_LAB` work — not stranger-network sims or weaponized red playbooks.
Assemble checklist covering Modules 1–9: purple mindset and lab scope, purple concepts, detection engineering basics, sigma and SIEM rules, testing detections, atomic simulation literacy, ATT&CK exercise design, coverage and tuning, findings and feedback loop. Use on capstone walk of YOUR `$PURPLE_LAB` — never stranger org attack sims, never weaponized red playbooks, never unauthorized prod atomic or rule deploy, never blind-side prod SOC. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab/t35-purple/. Integrity rows: `$PURPLE_LAB` only, lab VMs authorized, no weaponized playbooks, limitations documented.
1. Scope and ethics
$PURPLE_LAB named with RoE reference. NEVER stranger-network sims, NEVER weaponized red playbooks, NEVER unauthorized prod purple work, NEVER blind-side prod SOC.
Atomic module = detection validation on YOUR lab VMs — not attack chain cookbooks.
Command guide
Try these commands — Scope and ethics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Atomic Red Team — https://github.com/redcanaryco/atomic-red-team
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/notes/capstone-checklist.txt" <<'EOF'
[ ] lab.env + rules/ telemetry/ testing/ atomic/ exercises/ coverage/ findings/
[ ] roe.txt + no-stranger-sims.txt reviewed
[ ] Purple concepts: red-blue-purple + methodology + roles
[ ] DE basics: detection-as-code + telemetry needs + FP cost
[ ] failed-logon-lab.yml Sigma stub + auth.jsonl seed
[ ] jq validate rule logic (UT-01 MATCH)
[ ] Atomic literacy: clone/read steps + safe T1082 list — install optional
[ ] Exercise plan PURPLE-LAB-001 + coverage.csv
[ ] Findings: PURPLE-FND-001 + blue-backlog.csv + retro template
[ ] never: stranger-network sims / ransomware atomics / cred dump homework
EOFCommand — copy this
grep '\[ \]' "$PURPLE_LAB/notes/capstone-checklist.txt"
python3 -c "print('Capstone: Purple Teaming — YOUR t35-purple lab only')"Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
Detection engineering, sigma/SIEM, testing, atomic sim, exercise design, coverage, findings — linked rows.
Cross-link Topic 34 Incident Response as upstream context — separate authorized track.
3. Teardown
Notes secured chmod 600, evidence pack ready, lab stubs archived per brief.
Retention note for mentor handoff.
4. What you ship: Topic 35 capstone checklist
One-page Purple Teaming literacy capstone checklist for $PURPLE_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'weaponized red playbook for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Weaponized red playbooks required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice