Checklist
Topic 29 capstone checklist — SOC mindset, SIEM, triage, detections, ticketing, reporting on $SOC_LAB.
Visual · t29_capstone_checklist
Checklist consolidates SOC Level 1 literacy pillars. $SOC_LAB only. Original Cyberlium.
Capstone proves SOC L1 literacy on YOUR authorized lab work — not a portfolio of unauthorized SIEM access or attack-generated alerts.
Assemble checklist covering Modules 1–9: SOC mindset and lab logs, fundamentals and roles, SIEM literacy, log sources, detection rules, alert triage, common detections named (phishing/malware/brute triage literacy only), ticketing and escalation, reporting and handoff. Use on capstone walk of YOUR $SOC_LAB — never unauthorized prod SIEM, never phishing/malware/brute attack execution, never prod ticket or escalation without RoE, never prod case paste. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab. Integrity rows: $SOC_LAB only, RoE stated, dispositions evidenced, limitations documented, detection classes as triage vocabulary not offensive cookbooks.
1. Scope and ethics
$SOC_LAB named with RoE reference. NEVER unauthorized SIEM, NEVER attack-generated alerts, NEVER prod tickets/escalation, NEVER offensive detection cookbooks.
Named attack classes are triage literacy on sample alerts — separate from refused offensive paths.
Command guide
Try these commands — Scope and ethics
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: SOC capstone (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Elastic (https://www.elastic.co/guide/en/security/current/index.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
Mindset, SIEM, sources, rules, triage, detections, ticketing, reporting — linked rows.
Cross-link Topic 28 crypto as separate track — do not mix unauthorized tooling into SOC pack.
3. Teardown
Notes secured chmod 600, report pack ready, lab sample exports archived optional per brief.
Archive retention note for mentor handoff.
4. What you ship: Topic 29 capstone checklist
One-page SOC Level 1 literacy capstone checklist for $SOC_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Checklist includes row 'run phishing campaign for capstone bonus.'
- Right: Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
APPLY: Checklist includes:
APPLY: True or False: Attack-generated alerts required for capstone.
APPLY: Teardown includes: