Purple › Module 10 › Lesson 2
Lab Path
Purple Teaming literacy path on `$PURPLE_LAB` — lab setup to mentor handoff with ethics gates at every station.
Visual · t35_lab_path
Lab path = visual purple chain on YOUR $PURPLE_LAB. Original Cyberlium.
Opening
Draw the path from lab scope to mentor handoff — with stop signs at every stranger-network shortcut and weaponized playbook lane.
Document literacy path: `$PURPLE_LAB` setup → purple concepts → detection engineering → sigma/SIEM → testing → atomic sim → exercise design → coverage/tuning → findings → capstone. Ethics gates: stranger org attack sims, weaponized red playbooks, unauthorized prod atomic or rule deploy, blind-side prod SOC, EDR disable to pass detection — refused paths labeled red. UTC milestones and artifact IDs per station. Mermaid or sketch chmod 600. Honest N/A if brief skipped live lab host — labeled. Defender breakpoint: where RoE or scope discipline prevented out-of-scope purple action.
1. Path stations
Setup, concepts, DE, sigma/SIEM, testing, atomic, exercise design, coverage, findings, handoff — ten minimum stations.
Each station links evidence index row and module lesson ID.
Command guide
Try these commands — Path stations
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Atomic Red Team — https://redcanary.com/atomic-red-team/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
echo '=== Capstone path: mindset → concepts → DE → Sigma → test → atomic literacy → exercise → coverage → findings ==='
grep -E 'T1110|failed-logon' "$PURPLE_LAB/rules/failed-logon-lab.yml" "$PURPLE_LAB/coverage/coverage.csv"
grep -E 'PURPLE-LAB-001|PURPLE-FND' "$PURPLE_LAB/exercises/PURPLE-LAB-001.md" "$PURPLE_LAB/findings/blue-backlog.csv"
curl -sS https://sigmahq.io/ | head -5
curl -sS https://attack.mitre.org/ | head -5Primary tools to practice this lesson: curl, grep. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Atomic Red Team (https://redcanary.com/atomic-red-team/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics overlay
Red stops: stranger org sims, weaponized playbooks, unauthorized prod purple, blind-side SOC, EDR disable.
RoE branch always green start — `$PURPLE_LAB` on separate labeled branch.
3. Integrity breakpoint
Mark where scope check prevented out-of-RoE sim or prod access.
One paragraph uplift from YOUR `$PURPLE_LAB` path.
4. What you ship: lab path diagram
Purple chain with ethics gates + UTC milestones — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Lab path includes stranger org attack sim shortcut lane.
Right
Lab path documented for $PURPLE_LAB. Next: Evidence Pack.
Mission: lab path diagram
1) Map ten stations. 2) Add six ethics gates. 3) UTC milestones per station. 4) Link evidence index IDs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
Knowledge Check
APPLY: Lab path documents:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger org sim shortcut OK on path.
True or False
Knowledge Check
APPLY: Path ends at:
Multiple choice