Lab — Capstone
Execute capstone on $SOC_LAB — checklist, lab path, evidence pack sealed; zero unauthorized access.
Visual · t29_capstone_lab
Capstone: checklist × $SOC_LAB literacy evidence. Original Cyberlium.
Close the SOC Level 1 literacy loop — triage shipped, tickets documented, handoff ready, RoE signed — without unauthorized SIEM or attack-generated alerts.
Walk Topic 29 checklist on YOUR $SOC_LAB: verify RoE, lab path current, triage and detections labs complete, ticket and report labs indexed, evidence pack sealed, scan for attack cookbooks and prod paste (must be zero). Update index with capstone UTC completion. Integrity paragraph: triage discipline and handoff hygiene key insight from YOUR path. No unauthorized prod SIEM, no phishing/malware/brute attack execution, no prod tickets/escalation, no prod case paste. Optional mentor review — three clarity questions. Archive lab exports after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero refused techniques in any file.
Scan sealed pack for attack scripts and prod paste — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SOC capstone — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Elastic — https://www.elastic.co/guide/en/security/current/index.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows:
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
grep NEVER "$SOC_LAB/notes/no-unauthorized-siem.txt"
grep 'HARD BAN' "$SOC_LAB/notes/brute-detection-literacy.txt"
echo '=== Capstone: seed → enrich → FP/TP → ticket → handoff ==='
jq '.[] | select(.id=="ALR-002")' "$SOC_LAB/logs/alerts.json"
jq -c 'select(.src_ip=="203.0.113.50")' "$SOC_LAB/logs/auth.jsonl"
grep -E 'TP|FP' "$SOC_LAB/notes/triage-queue-summary.txt"
grep INC-LAB "$SOC_LAB/tickets/ticket-index.txt"
grep Escalated "$SOC_LAB/handoff/handoff-summary.md"
python3 - <<'PY'
import os
lab = os.environ.get('SOC_LAB', os.path.expanduser('~/cyberlium-lab/t29-soc'))
path = os.path.join(lab, 'handoff', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'SOC Level 1 Defensive Capstone',
'scope: YOUR $HOME/cyberlium-lab/t29-soc/ only',
'seed: auth.jsonl + proxy.jsonl + alerts.json (FAKE events)',
'enrich: jq failed logons, rare IP 203.0.113.50, proxy blocks',
'detect: failed-logon-lab.yml sigma stub (T1110.001)',
'triage: ALR-001 FP, ALR-002 TP escalate, ALR-003 phishing, ALR-004 info',
'ticket: INC-LAB-002 + INC-LAB-003 + escalation template',
'handoff: case notes + evidence pack + shift template',
'never: hydra / real SIEM dumps / phishing kits / malware payloads / stranger attacks'
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|triage' "$SOC_LAB/handoff/capstone-summary.txt"
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t29-soc/notes/no-unauthorized-siem.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t29-soc/handoff/capstone-summary.txt | Select-String never findstr ALR-002 $HOME/cyberlium-lab/t29-soc/logs/alerts.json
Primary tools to practice this lesson: grep, jq, python3. Reference sites: SOC capstone (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Elastic (https://www.elastic.co/guide/en/security/current/index.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
RoE + triage discipline key → professional handoff idea from YOUR lab path.
Name what breaks if you skip scope or run unauthorized attacks — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 30 SOC Level 2 & 3 on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero refused scan.
5. What you record before the next lesson
Capstone pack path. $SOC_LAB quiet.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Capstone includes phishing campaign walkthrough as bonus exhibit.
- Right: Capstone complete on $SOC_LAB with full teardown. Next: topic quiz.
Mission: Topic 29 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero refused files. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
APPLY: Capstone target:
APPLY: True or False: Attack-generated alerts earn capstone credit.
APPLY: Capstone teardown includes: