Purple › Module 8 › Lesson 4
Lab — Coverage
Coverage and tuning lab on `$PURPLE_LAB` — coverage matrix, gap register, tuning loop bundled.
Visual · t35_coverage_lab
Lab: coverage/tuning pack on YOUR $PURPLE_LAB. Original Cyberlium.
Opening
Ship coverage artifacts from YOUR lab — matrix, gaps, tuning loop — zero fabricated coverage or unauthorized prod rule deploy.
On YOUR `$PURPLE_LAB` per brief: (1) scope proof — exercise thread Modules 6–7 labeled; (2) coverage matrix stub Module 8-1; (3) gap register Module 8-2; (4) tuning loop iteration Module 8-3; (5) coverage summary stub (tested count, open gaps, next sprint priority); (6) integrity — `$PURPLE_LAB` only, honest status, no unauthorized prod changes, no fabricated coverage; (7) chmod 600 pack. Cross-link Modules 6–7 atomic and exercise work — professional coverage literacy handoff.
1. Lab deliverables
Matrix + gaps + tuning loop cross-indexed — single coverage thread.
Summary cites honest tested vs untested counts — not all-green fiction.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Splunk security content — https://github.com/splunk/security_content
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/coverage/coverage.csv" <<'EOF'
technique_id,technique_name,rule_file,test_method,last_validated,status,notes
T1110.001,Password Guessing,failed-logon-lab.yml,auth.jsonl jq,2026-08-22,validated,UT-01 MATCH jsmith
T1082,System Information Discovery,,optional T1082 lab VM,,gap,write rule or enable audit
T1059.001,PowerShell,,not tested,,gap,seed process jsonl if assigned
T1078,Valid Accounts,failed-logon-lab.yml+correlate,auth.jsonl sequence,2026-08-22,partial,4625 then 4624 same user
EOFCommand — copy this
grep -E 'T1110|T1082|validated|gap' "$PURPLE_LAB/coverage/coverage.csv" grep -E 'T1110|gap' "$PURPLE_LAB/coverage/gap-analysis.md" "$PURPLE_LAB/coverage/coverage-matrix-template.md"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t35-purple/coverage/coverage.csv | Select-String T1110
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Splunk security content (https://github.com/splunk/security_content). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each gap links matrix row and proposed action — not orphan complaints.
Zero unauthorized prod rule deploy notes in pack.
3. Teardown
Secure notes chmod 600; coverage pack ready for findings module.
Archive stub optional per brief.
4. What you ship: coverage lab pack
Matrix + gap register + tuning loop + summary + integrity — chmod 600.
5. What you record before the next lesson
Coverage lab pack path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Coverage lab includes fabricated all-green matrix without any atomic validation.
Right
Coverage lab pack on `$PURPLE_LAB`. Next: quiz.
Mission: coverage lab
1) Scope and exercise thread proof. 2) Coverage matrix and gap register. 3) Tuning loop iteration. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Coverage summary — minimum metric rows?”
Knowledge Check
APPLY: Coverage lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Fabricated tested status is acceptable.
True or False
Knowledge Check
APPLY: Coverage lab pack should:
Multiple choice