SOC › Module 9 › Lesson 4
Lab — Report
Reporting lab on $SOC_LAB — case notes, L2 handoff, shift log bundled as mentor handoff pack.
Visual · t29_report_lab
Lab: reporting and handoff pack from YOUR $SOC_LAB work. Original Cyberlium.
Opening
Ship a mentor-ready handoff pack — case notes, L2 block, shift log — zero prod case paste or unauthorized escalation.
From $SOC_LAB labs Modules 6–8: (1) report cover — scope, RoE reference, analyst, UTC; (2) case notes timeline from Module 9-1 on one TP stub; (3) L2 handoff block from Module 9-2; (4) shift hygiene log with open items; (5) ticket and alert cross-index; (6) limitations paragraph (practice vs prod, brief gaps); (7) integrity — $SOC_LAB only, no prod case paste, no unauthorized escalation, no attack repro in notes; (8) chmod 600 index.md. Professional tone — L2-readable. Share-safe redaction optional per brief.
1. Report pack
Case notes + L2 handoff + shift log + ticket index — cross-link prior labs.
Limitations paragraph mandatory — honest gaps.
Command guide
Try these commands — Report pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
IR reporting — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final Elastic cases — https://www.elastic.co/guide/en/security/current/cases-ui.html FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
python3 - <<'PY'
import os
lab = os.environ.get('SOC_LAB', os.path.expanduser('~/cyberlium-lab/t29-soc'))
path = os.path.join(lab, 'handoff', 'handoff-summary.md')
open(path, 'w').write('
'.join([
'# SOC L1 Handoff Summary (YOUR lab)',
'## Escalated',
' - ALR-002 → INC-LAB-002 → L2 (external admin brute, TP)',
'## Closed FP/Info',
' - ALR-001 FP, ALR-004 info',
'## User actions',
' - ALR-003 bob phishing — INC-LAB-003, awareness ticket',
'## Artifacts location: handoff/evidence-pack-ALR-002.txt',
'## Refusals: no hydra, no real SIEM dumps, no phishing kits'
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'Escalated|Refusals|TP' "$SOC_LAB/handoff/handoff-summary.md" grep INC-LAB "$SOC_LAB/tickets/ticket-index.txt"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t29-soc/handoff/handoff-summary.md | Select-String Escalated Get-Content $HOME/cyberlium-lab/t29-soc/handoff/evidence-pack-ALR-002.txt | Select-String EVIDENCE
Primary tools to practice this lesson: grep, python3. Reference sites: IR reporting (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Elastic cases (https://www.elastic.co/guide/en/security/current/cases-ui.html); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Every timeline entry cites observed stub; handoff has eight fields complete.
Zero attack cookbooks in next steps or notes.
3. Integrity scan
Scan for prod case paste, unauthorized escalation, sensational claims — zero hits.
Practice label if brief requires.
4. What you ship: report lab pack
Case notes + handoff + shift log + index + integrity — chmod 600.
5. What you record before the next lesson
Report lab pack path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Report lab includes employer prod case export and unauthorized L2 page.
Right
Report lab pack on $SOC_LAB. Next: quiz.
Mission: report lab
1) Case notes timeline on TP stub. 2) L2 handoff eight fields. 3) Shift log open items. 4) Integrity scan; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum timeline entries if brief sparse?”
Knowledge Check
APPLY: Report lab includes:
Multiple choice
Knowledge Check
APPLY: True or False: Hide limitations in report lab.
True or False
Knowledge Check
APPLY: Handoff next steps should:
Multiple choice