Purple › Module 9 › Lesson 4
Lab — Findings
Findings and feedback lab on `$PURPLE_LAB` — finding register, blue backlog, retrospective bundled.
Visual · t35_findings_lab
Lab: findings/feedback pack on YOUR $PURPLE_LAB. Original Cyberlium.
Opening
Ship findings artifacts from YOUR exercise thread — findings, backlog, retro — zero blame theater or unauthorized prod tickets.
On YOUR `$PURPLE_LAB` per brief: (1) scope proof — full exercise thread Modules 6–8 labeled; (2) purple finding register Module 9-1; (3) blue backlog stub Module 9-2; (4) retrospective preview Module 9-3; (5) feedback loop diagram stub (finding → backlog → retro → next sprint); (6) integrity — `$PURPLE_LAB` only, blameless language, no unauthorized prod tickets, honest negative results; (7) chmod 600 pack. Cross-link entire Topic 35 thread — professional purple feedback handoff.
1. Lab deliverables
Findings + backlog + retro cross-indexed — single feedback thread.
Loop diagram links finding IDs to backlog items — accountability.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma — https://sigmahq.io/ MITRE ATT&CK — https://attack.mitre.org/ Elastic detection — https://www.elastic.co/guide/en/security/current/rules-ui.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/findings/findings-lab-summary.md" <<'EOF'
# Findings Lab Summary — YOUR lab
- purple-findings-template.md: structured finding format
- blue-backlog.csv: prioritized remediation queue
- retro-template.md: post-exercise feedback loop
## Sample finding seeded
- PURPLE-FND-001 from PURPLE-LAB-001 (T1110.001 tune)
## Refusals
- No credential dump findings from banned atomics
EOFCommand — copy this
grep -E 'PURPLE-FND-001|backlog|Refusals' "$PURPLE_LAB/findings/findings-lab-summary.md" grep PURPLE-FND "$PURPLE_LAB/findings/blue-backlog.csv" "$PURPLE_LAB/exercises/PURPLE-LAB-001.md" ls "$PURPLE_LAB/findings/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t35-purple/findings/blue-backlog.csv | Select-String PURPLE-FND
Primary tools to practice this lesson: grep, python3. Reference sites: Sigma (https://sigmahq.io/); MITRE ATT&CK (https://attack.mitre.org/); Elastic detection (https://www.elastic.co/guide/en/security/current/rules-ui.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Acceptance criteria present in backlog — not optional.
Blameless language throughout — system gaps only.
3. Teardown
Secure notes chmod 600; findings pack ready for capstone evidence index.
Archive stub optional per brief.
4. What you ship: findings lab pack
Findings + backlog + retro + loop diagram + integrity — chmod 600.
5. What you record before the next lesson
Findings lab pack path.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Findings lab includes blame-focused personal attack section as retro deliverable.
Right
Findings lab pack on `$PURPLE_LAB`. Next: quiz.
Mission: findings lab
1) Scope and full thread proof. 2) Finding register and blue backlog. 3) Retrospective preview. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Feedback loop diagram — minimum nodes?”
Knowledge Check
APPLY: Findings lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Blame theater belongs in findings lab.
True or False
Knowledge Check
APPLY: Findings lab pack should:
Multiple choice