Evidence Pack

Bundle Topic 35 literacy evidence from `$PURPLE_LAB` — DE, sigma/SIEM, testing, atomic, exercise design, coverage, findings; no weaponized refs.

Evidence Pack• Audio Walkthrough

00:00/02:57

Visual · t35_evidence_pack

Evidence pack = mentor handoff from $PURPLE_LAB literacy. Original Cyberlium.

One indexed pack beats scattered purple notes — and never includes weaponized playbooks or stranger org sim refs.

Assemble evidence pack: `$PURPLE_LAB` RoE, lab setup proof, detection engineering and sigma/SIEM labs if brief assigned, testing and atomic labs, exercise design pack, coverage lab, findings lab, integrity statement (lab VMs only, no weaponized playbooks, no stranger org sims, no unauthorized prod access, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + matrix stubs + diagrams, not weaponized red guides. Gap paragraph for Topic 36 DevSecOps — separate authorized track. Scan folder for weaponized playbook refs, stranger org sim notes, prod keys — zero tolerance.

1. Pack contents

Minimum: RoE, DE, sigma/SIEM, testing, atomic, exercise design, coverage, findings, integrity index.

Optional: module labs per brief — no refused technique files.

Command guide

Try these commands — Pack contents

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Sigma — https://sigmahq.io/ Elastic detection — https://www.elastic.co/guide/en/security/current/rules-ui.html Splunk security content — https://github.com/splunk/security_content

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
python3 - <<'PY'
import os
lab = os.environ.get('PURPLE_LAB', os.path.expanduser('~/cyberlium-lab/t35-purple'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
  'CAPSTONE EVIDENCE INDEX — YOUR t35-purple lab only',
  'Ethics: roe.txt, no-stranger-sims.txt, exercise-roe.md',
  'Concepts: red-blue-purple, purple-methodology, purple-roles-comms',
  'DE: detection-as-code, telemetry-needs, false-positive-cost',
  'Sigma: failed-logon-lab.yml + sigma-named + rule-lifecycle',
  'Testing: auth.jsonl seed + unit-test-plan + jq validation',
  'Atomic: atomic-literacy + safe-tests-list + clone-read-steps (optional install)',
  'Exercise: PURPLE-LAB-001.md + exercise-plan-template + technique-selection',
  'Coverage: coverage.csv + gap-analysis + tuning-loop',
  'Findings: PURPLE-FND-001 + blue-backlog.csv + retro-template',
  'Refusals: no stranger-network sims / ransomware atomics / cred dump homework',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'failed-logon|coverage.csv|Refusals' "$PURPLE_LAB/notes/capstone-evidence-index.txt"

Primary tools to practice this lesson: grep, python3. Reference sites: Sigma (https://sigmahq.io/); Elastic detection (https://www.elastic.co/guide/en/security/current/rules-ui.html); Splunk security content (https://github.com/splunk/security_content). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.