SOC › Module 10 › Lesson 1
Checklist
Topic 29 capstone checklist — SOC mindset, SIEM, triage, detections, ticketing, reporting on $SOC_LAB.
Visual · t29_capstone_checklist
Checklist consolidates SOC Level 1 literacy pillars. $SOC_LAB only. Original Cyberlium.
Opening
Capstone proves SOC L1 literacy on YOUR authorized lab work — not a portfolio of unauthorized SIEM access or attack-generated alerts.
Assemble checklist covering Modules 1–9: SOC mindset and lab logs, fundamentals and roles, SIEM literacy, log sources, detection rules, alert triage, common detections named (phishing/malware/brute triage literacy only), ticketing and escalation, reporting and handoff. Use on capstone walk of YOUR $SOC_LAB — never unauthorized prod SIEM, never phishing/malware/brute attack execution, never prod ticket or escalation without RoE, never prod case paste. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab. Integrity rows: $SOC_LAB only, RoE stated, dispositions evidenced, limitations documented, detection classes as triage vocabulary not offensive cookbooks.
1. Scope and ethics
$SOC_LAB named with RoE reference. NEVER unauthorized SIEM, NEVER attack-generated alerts, NEVER prod tickets/escalation, NEVER offensive detection cookbooks.
Named attack classes are triage literacy on sample alerts — separate from refused offensive paths.
Command guide
Try these commands — Scope and ethics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SOC capstone — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Elastic — https://www.elastic.co/guide/en/security/current/index.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/notes/capstone-checklist.txt" <<'EOF'
[ ] lab.env + logs/ notes/ rules/ tickets/ handoff/ dirs
[ ] roe.txt + no-unauthorized-siem.txt reviewed
[ ] auth.jsonl + proxy.jsonl + alerts.json seeded (FAKE events)
[ ] jq failed logons + rare IP queries on YOUR logs
[ ] linux-auth.sample + log-parse-summary.txt
[ ] failed-logon-lab.yml sigma stub + validation
[ ] triage worksheets ALR-001/002 + queue summary
[ ] phishing/malware/brute DETECTION notes + jq on alerts
[ ] INC-LAB tickets + escalation template
[ ] case notes + shift handoff + evidence pack
[ ] never: hydra / real SIEM dumps / phishing kits / malware payloads
EOFCommand — copy this
grep '\[ \]' "$SOC_LAB/notes/capstone-checklist.txt"
python3 -c "print('Capstone: SOC L1 detection literacy — YOUR t29-soc lab only')"Primary tools to practice this lesson: grep, python3. Reference sites: SOC capstone (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Elastic (https://www.elastic.co/guide/en/security/current/index.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
Mindset, SIEM, sources, rules, triage, detections, ticketing, reporting — linked rows.
Cross-link Topic 28 crypto as separate track — do not mix unauthorized tooling into SOC pack.
3. Teardown
Notes secured chmod 600, report pack ready, lab sample exports archived optional per brief.
Archive retention note for mentor handoff.
4. What you ship: Topic 29 capstone checklist
One-page SOC Level 1 literacy capstone checklist for $SOC_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'run phishing campaign for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Attack-generated alerts required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice