Roles Comms
Roles comms literacy names exercise briefings, findings handoffs, and detection backlog channels — assign comms on YOUR $PURPLE_LAB tabletop roster.
Visual · t35_roles_comms
Roles comms literacy. $PURPLE_LAB only. Original Cyberlium.
Sim logs without handoffs waste blue time — literacy names purple comms so findings reach detection engineers on lab exercises you document.
Purple comms include pre-exercise briefings — scope, techniques, expected telemetry. During-exercise status — red progress, blue alert queue. Post-exercise findings — technique ID, detection result, tuning recommendation, backlog ticket. One accountable channel prevents duplicate work and lost findings. Cyberlium maps comms on YOUR $PURPLE_LAB — assign comms artifacts for three fictional exercise phases. Next: Concepts Lab.
1. Comms artifacts (named)
Pre-exercise brief: scope, lab hosts, ATT&CK techniques, success criteria, rules of engagement. Status cadence: red technique log, blue alert summary, purple gap notes. Findings report: technique, detection result, tuning action, backlog priority.
On $PURPLE_LAB, write comms row — phase, artifact, owner role for one fictional exercise.
Command guide
Try these commands — Comms artifacts (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Splunk security content (https://github.com/splunk/security_content); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why comms literacy prevents lost findings
Red sim logs in chat without ticket lose detection follow-up. Blue tunes wrong rule because handoff lacked technique context. Documented comms survive shift changes and feed coverage matrices.
Students assign lab comms on notes — production comms follow org templates and ticketing systems.
3. Lab boundary
Forbidden: sharing sim results against stranger networks in public channels. Allowed: roles comms card — three phases with $PURPLE_LAB fictional artifacts.
Ship: roles comms card for YOUR lab exercise. Next: Concepts Lab.
4. What you ship: roles comms card for $PURPLE_LAB
Pre, during, post comms artifacts with owners. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Roles comms card. $PURPLE_LAB named. File t35-m02-l03-roles-comms.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Post sim logs in Discord without findings format. Skip pre-exercise brief entirely.
- Right: Write roles comms card for YOUR $PURPLE_LAB. Next: Concepts Lab.
Mission: assign comms on YOUR lab exercise
1) Define pre, during, post comms artifacts. 2) Write comms row for three exercise phases. 3) Confirm one owner per artifact. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Findings report is the handoff — sim without report is entertainment, not engineering.
APPLY: Post-exercise findings report primarily:
APPLY: True or False: Pre-exercise brief includes scope, lab hosts, and success criteria.
APPLY: Roles comms literacy on Cyberlium uses: