SOC › Module 9 › Lesson 1
Case Notes
Case notes literacy — timeline, observed vs inferred, evidence links — on $SOC_LAB investigation stubs.
Visual · t29_case_notes
Case notes = structured analyst narrative. $SOC_LAB. Original Cyberlium.
Opening
Case notes outlive the shift — draft timelines the way L2 can actually continue the investigation.
Case notes literacy: UTC timeline entries, observed facts vs analyst inference separated, alert and ticket ID links, enrichment citations from Module 6, disposition rationale, open questions for next analyst, and professional tone without sensationalism. Analyst drafts case notes on $SOC_LAB investigation stub from Module 8 ticket — chmod 600 — without copying prod case data without authorization, without fabricating evidence, without blaming users in notes. Cyberlium templates mirror DFIR exhibit discipline at L1 depth. Refused: pasting real prod case exports, doxing users from logs, notes that read like attack cookbooks. Lab row: one case note timeline with five UTC entries minimum.
1. Note structure
Timeline UTC, observed, inferred, links, open questions — five literacy sections.
Notes support handoff Module 9-2 — not standalone alert dumps.
Command guide
Try these commands — Note structure
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Case management — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final Elastic cases — https://www.elastic.co/guide/en/security/current/cases-ui.html MITRE — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
python3 - <<'PY'
import os
lab = os.environ.get('SOC_LAB', os.path.expanduser('~/cyberlium-lab/t29-soc'))
path = os.path.join(lab, 'handoff', 'case-notes-ALR-002.md')
os.makedirs(os.path.dirname(path), exist_ok=True)
open(path, 'w').write('
'.join([
'# Case Notes — ALR-002 (for L2 handoff)',
'## Timeline (YOUR seeded logs)',
' 02:16:12Z — 4625 administrator from 203.0.113.50 (unknown user)',
' 02:16:15Z — 4625 administrator bad password from 203.0.113.50',
'## Analyst actions taken',
' - jq enriched auth.jsonl for 203.0.113.50',
' - Opened INC-LAB-002, marked TP',
' - Recommended perimeter block (lab documentation)',
'## Open questions for L2',
' - Any other hosts targeted by 203.0.113.50?',
' - GeoIP / threat intel lookup (use public docs literacy only)',
'## Artifacts: auth.jsonl, alerts.json, failed-logon-lab.yml'
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'Timeline|L2|203.0.113' "$SOC_LAB/handoff/case-notes-ALR-002.md"
Primary tools to practice this lesson: python3, grep. Reference sites: Case management (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Elastic cases (https://www.elastic.co/guide/en/security/current/cases-ui.html); MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence discipline
Cite alert field or log line stub — same integrity as triage disposition.
Inference labeled: 'may indicate' not 'confirmed APT' without proof.
3. Scope refuse
No prod case paste without authorization; no fabricated evidence rows.
Case notes literacy supports handoff — not narrative fiction.
4. What you ship: case notes template
Timeline template + one completed $SOC_LAB stub row + NEVER prod case paste line.
5. What you record before the next lesson
Case notes template path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paste employer prod case export into lab notes as 'realism.'
Right
Case notes template with one $SOC_LAB stub timeline. Next: Handoff L2.
Mission: case notes template
1) List note structure sections. 2) Five UTC timeline entries on stub. 3) Separate observed vs inferred. 4) Write NEVER prod case paste line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Open questions — minimum for L2?”
Knowledge Check
APPLY: Case notes require:
Multiple choice
Knowledge Check
APPLY: True or False: Pasting unauthorized prod case exports is lab.
True or False
Knowledge Check
APPLY: Inference should:
Multiple choice