Purple › Module 1 › Lesson 4
Lab — Setup
Pack purple scope, lab host inventory, and ethics card — lab setup file only, dest $PURPLE_LAB.
Visual · t35_lab_setup
Lab: write purple setup pack. $PURPLE_LAB only. Original Cyberlium.
Opening
Lab setup before purple exercises — scope paperwork detection mentors expect.
Lessons 1–3 defined why purple matters, lab hosts only, and stranger-sim refusal. This lab ships the combined artifact: topic scope paragraph, lab host inventory row, and ethics card for $PURPLE_LAB under $HOME/cyberlium-lab/t35-purple/. No stranger-network sims or third-party tenant work required — scope and host paperwork first. Next: Quiz — Purple Mindset and Lab.
1. Lab contract: write the setup pack
Create $HOME/cyberlium-lab/t35-m01-l04-lab-setup.txt with date, operator, $PURPLE_LAB placeholder, literacy vs unauthorized simulation paragraph, lab host inventory row, and ethics card.
Optional: one-line proof your t35-purple folder exists — still no stranger-network sim or third-party tenant work required in this lab.
Command guide
Try these commands — Lab contract: write the setup pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma — https://sigmahq.io/ Atomic Red Team — https://github.com/redcanaryco/atomic-red-team Elastic detection — https://www.elastic.co/guide/en/security/current/detection-engine-overview.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/roe.txt" <<'EOF'
PURPLE_LAB=$HOME/cyberlium-lab/t35-purple
targets: YOUR Sigma stubs, YOUR FAKE telemetry jsonl, YOUR exercise plans in lab folder
never: attack sims against production stranger networks
never: ransomware atomics; credential dump atomics as homework
never: destructive stranger sims; probe unauthorized infrastructure
allowed: failed-logon Sigma stub; auth.jsonl seed; jq validate rule logic
allowed: curl sigmahq.io / atomic-red-team / attack.mitre.org; coverage CSV
allowed: Invoke-AtomicTest ONLY on YOUR lab VM + safe tests like T1082 system info
output: detection tests, exercise plans, findings backlog in lab folder
EOFCommand — copy this
chmod 600 "$PURPLE_LAB/roe.txt" grep -E 'PURPLE_LAB|never|allowed|YOUR' "$PURPLE_LAB/roe.txt" command -v jq >/dev/null && jq --version || echo 'jq optional — install for telemetry validation lab' ls -la "$PURPLE_LAB/rules" "$PURPLE_LAB/telemetry" "$PURPLE_LAB/exercises"
═══ WINDOWS ═══
Run on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t35-purple/roe.txt | Select-String never Get-ChildItem $HOME/cyberlium-lab/t35-purple/rules, $HOME/cyberlium-lab/t35-purple/telemetry
Primary tools to practice this lesson: grep, curl. Reference sites: Sigma (https://sigmahq.io/); Atomic Red Team (https://github.com/redcanaryco/atomic-red-team); Elastic detection (https://www.elastic.co/guide/en/security/current/detection-engine-overview.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for 'stranger-network sim,' third-party tenant targeting steps, live victim breach scripts — redact or delete. Rewrite forum habits to $PURPLE_LAB placeholders before you copy workflows.
Classmates build their own setup packs for their $PURPLE_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then Red Blue Purple.
Purple mentors archive lab setup before first detection exercise; you are practicing that habit early.
4. What you ship: purple lab setup pack for $PURPLE_LAB
Setup pack: scope, host row, ethics card. $PURPLE_LAB named. NEVER stranger sims. chmod 600.
5. What you record before the next lesson
Date. Setup pack path. $PURPLE_LAB scope note. File t35-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and import live victim breach script. Add stranger-network sim to approved list.
Right
Write YOUR lab setup pack for $PURPLE_LAB. chmod 600. Next: Quiz — Purple Mindset and Lab.
Mission: freeze YOUR purple lab setup pack on disk
1) Merge scope, host inventory, ethics sections. 2) Name $PURPLE_LAB. 3) chmod 600. Never list stranger-network attack sims as approved practice.
Stuck? Ask Cyberlium AI Mentor
Setup packs are boring on purpose — boring keeps purple work defensible.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on purple lab notes.
True or False
Knowledge Check
APPLY: A tutorial simulates stranger networks without scope. You:
Multiple choice