Lab — Tickets
Ticketing lab on $SOC_LAB — practice tickets, escalation decisions, SLA table from triage dispositions.
Visual · t29_ticket_lab
Lab: ticketing pack on YOUR $SOC_LAB practice queue. Original Cyberlium.
Ship ticketing artifacts from YOUR practice dispositions — tickets, escalation, SLA — zero unauthorized prod case systems.
On YOUR $SOC_LAB per brief: (1) scope proof — practice ticket template labeled; (2) ≥2 practice tickets from Module 6–7 TP dispositions with full field rows; (3) escalation decision table three scenarios; (4) SLA hygiene table linked to tickets; (5) handoff minimum checklist completed for one escalate-yes row; (6) integrity — $SOC_LAB practice only, no unauthorized prod tickets, no SLA fraud; (7) chmod 600 pack. Tickets cite alert IDs and enrichment from prior labs — professional tone.
1. Lab deliverables
Tickets + escalation + SLA cross-indexed to triage dispositions.
UTC on every ticket touch — same discipline as shift notes Module 9.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST IR communication — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/ Elastic cases — https://www.elastic.co/guide/en/security/current/cases-ui.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/tickets/ticket-index.txt" <<'EOF'
YOUR lab ticket index:
INC-LAB-002 — ALR-002 external admin brute (High, escalate L2)
INC-LAB-003 — ALR-003 phishing block (Medium, user awareness)
ALR-001 — closed FP (jsmith typo)
ALR-004 — closed info (scheduled task verified)
Templates: escalation-template.md
All tickets reference YOUR seeded logs — not live corp data
EOFCommand — copy this
grep -E 'INC-LAB|ALR-|YOUR' "$SOC_LAB/tickets/ticket-index.txt" ls -la "$SOC_LAB/tickets/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t29-soc/tickets/ticket-index.txt | Select-String INC-LAB Get-Content $HOME/cyberlium-lab/t29-soc/tickets/escalation-template.md | Select-String L2
Primary tools to practice this lesson: grep, python3. Reference sites: NIST IR communication (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/); Elastic cases (https://www.elastic.co/guide/en/security/current/cases-ui.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Practice label on all tickets; redact real names in share-safe copy.
Alert ID links back to detections lab rows.
3. Integrity
Prod ticket creation or SLA fraud = zero credit.
Mentor pack chmod 600.
4. What you ship: ticket lab pack
Tickets + escalation + SLA + handoff checklist + integrity — chmod 600.
5. What you record before the next lesson
Ticket lab pack path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Ticket lab includes unauthorized prod P1 tickets opened for realism.
- Right: Ticket lab pack on $SOC_LAB practice queue. Next: quiz.
Mission: ticket lab
1) Scope proof. 2) Two practice tickets from dispositions. 3) Escalation and SLA rows. 4) Handoff checklist; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum ticket count if brief sparse?”
APPLY: Ticket lab scope:
APPLY: True or False: Prod ticket creation without RoE is lab.
APPLY: Ticket notes must: