Purple › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 35 literacy evidence from `$PURPLE_LAB` — DE, sigma/SIEM, testing, atomic, exercise design, coverage, findings; no weaponized refs.
Visual · t35_evidence_pack
Evidence pack = mentor handoff from $PURPLE_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered purple notes — and never includes weaponized playbooks or stranger org sim refs.
Assemble evidence pack: `$PURPLE_LAB` RoE, lab setup proof, detection engineering and sigma/SIEM labs if brief assigned, testing and atomic labs, exercise design pack, coverage lab, findings lab, integrity statement (lab VMs only, no weaponized playbooks, no stranger org sims, no unauthorized prod access, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + matrix stubs + diagrams, not weaponized red guides. Gap paragraph for Topic 36 DevSecOps — separate authorized track. Scan folder for weaponized playbook refs, stranger org sim notes, prod keys — zero tolerance.
1. Pack contents
Minimum: RoE, DE, sigma/SIEM, testing, atomic, exercise design, coverage, findings, integrity index.
Optional: module labs per brief — no refused technique files.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma — https://sigmahq.io/ Elastic detection — https://www.elastic.co/guide/en/security/current/rules-ui.html Splunk security content — https://github.com/splunk/security_content
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
python3 - <<'PY'
import os
lab = os.environ.get('PURPLE_LAB', os.path.expanduser('~/cyberlium-lab/t35-purple'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR t35-purple lab only',
'Ethics: roe.txt, no-stranger-sims.txt, exercise-roe.md',
'Concepts: red-blue-purple, purple-methodology, purple-roles-comms',
'DE: detection-as-code, telemetry-needs, false-positive-cost',
'Sigma: failed-logon-lab.yml + sigma-named + rule-lifecycle',
'Testing: auth.jsonl seed + unit-test-plan + jq validation',
'Atomic: atomic-literacy + safe-tests-list + clone-read-steps (optional install)',
'Exercise: PURPLE-LAB-001.md + exercise-plan-template + technique-selection',
'Coverage: coverage.csv + gap-analysis + tuning-loop',
'Findings: PURPLE-FND-001 + blue-backlog.csv + retro-template',
'Refusals: no stranger-network sims / ransomware atomics / cred dump homework',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'failed-logon|coverage.csv|Refusals' "$PURPLE_LAB/notes/capstone-evidence-index.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: Sigma (https://sigmahq.io/); Elastic detection (https://www.elastic.co/guide/en/security/current/rules-ui.html); Splunk security content (https://github.com/splunk/security_content). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$PURPLE_LAB only, lab VM discipline, no weaponized refs, share-safe export.
Scan before seal — remove accidental prod keys or stranger org sim notes.
4. What you ship: Purple Teaming evidence pack
Bundled deliverables + index + integrity — chmod 600, report not weaponized guides default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes weaponized red playbook and stranger org sim guide.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle DE through findings index. 2) Integrity statements. 3) Confirm zero weaponized refs. 4) Gap note for Topic 36 DevSecOps.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Weaponized red guides OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice