SOC › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 29 literacy evidence from $SOC_LAB — triage, detections, tickets, report; no unauthorized access.
Visual · t29_evidence_pack
Evidence pack = mentor handoff from $SOC_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered triage notes — and never includes attack cookbooks or prod case exports.
Assemble evidence pack: $SOC_LAB RoE, lab setup proof, triage lab, detections lab, ticket lab, report lab, SIEM/sources/rules artifacts if brief assigned, integrity statement (authorized practice only, dispositions evidenced, no unauthorized SIEM/tickets/escalation, detection classes as triage literacy only, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + diagrams + disposition table, not live attack scripts on USB. Gap paragraph for Topic 30 SOC Level 2 & 3 — separate authorized track. Scan folder for phishing send steps, malware source, brute-force scripts, prod case paste — zero tolerance.
1. Pack contents
Minimum: RoE, triage, detections, ticket, report, integrity index.
Optional: SIEM/rules module labs — no refused technique files.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
FP/TP analysis — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final Elastic false positives — https://www.elastic.co/guide/en/security/current/alerts-ui.html Sigma tuning — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
echo '=== Capstone step 2: FP/TP call + ticket ==='
grep TP "$SOC_LAB/notes/triage-worksheet-ALR-002.md"
grep FP "$SOC_LAB/notes/triage-worksheet-ALR-001.md"
grep INC-LAB "$SOC_LAB/tickets/INC-LAB-002.md"
python3 - <<'PY'
import os
lab = os.environ.get('SOC_LAB', os.path.expanduser('~/cyberlium-lab/t29-soc'))
idx = os.path.join(lab, 'handoff', 'capstone-evidence-index.txt')
open(idx, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR lab only',
'Logs: logs/auth.jsonl, proxy.jsonl, alerts.json, linux-auth.sample',
'Rules: rules/failed-logon-lab.yml',
'Triage: notes/triage-worksheet-ALR-001.md, ALR-002.md, triage-queue-summary.txt',
'Tickets: tickets/INC-LAB-002.md, INC-LAB-003.md, escalation-template.md',
'Handoff: handoff/case-notes-ALR-002.md, shift-handoff-template.md, evidence-pack-ALR-002.txt',
'Refusals: no hydra, no unauthorized SIEM, no phishing kits'
]))
print(f'Wrote {idx}')
PYPrimary tools to practice this lesson: grep, python3. Reference sites: FP/TP analysis (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Elastic false positives (https://www.elastic.co/guide/en/security/current/alerts-ui.html); Sigma tuning (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$SOC_LAB only, triage discipline, no unauthorized access, share-safe export.
Scan before seal — remove accidental prod paste or attack scripts.
4. What you ship: SOC Level 1 evidence pack
Bundled deliverables + index + integrity — chmod 600, report not attacks default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes phishing template and prod case export.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle triage detections ticket report index. 2) Integrity statements. 3) Confirm zero refused technique files. 4) Gap note for Topic 30 SOC Level 2 & 3.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Attack cookbooks OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice