Mod 10 · Les 3/5

Learn›SOC Level 2 & 3 with AI›Module 10›Lesson 3

In progress

Module 10•Lesson 3 of 5•⏱️ 15 min read•Beginner+39 XP

Evidence Pack

Bundle Topic 30 literacy evidence from $HUNT_LAB — hunt, IR, containment, eradication, PIR; no unauthorized access.

Evidence Pack• Audio Walkthrough

00:00/02:55

Visual · t30_evidence_pack

Evidence pack = mentor handoff from $HUNT_LAB literacy. Original Cyberlium.

One indexed pack beats scattered hunt notes — and never includes offensive playbooks or prod case exports.

Assemble evidence pack: $HUNT_LAB RoE, lab setup proof, hunting lab, ATT&CK lab, SIEM/correlation artifacts if brief assigned, IR lab, containment lab, eradication lab, PIR lab, integrity statement (authorized practice only, containment/eradication as defender decision literacy on lab host notes, no unauthorized prod IR, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + diagrams + hunt query stubs, not live attack scripts. Gap paragraph for Topic 31 Cloud Security — separate authorized track. Scan folder for lateral movement steps, malware source, prod case paste — zero tolerance.

1. Pack contents

Minimum: RoE, hunt, IR, containment, eradication, PIR, integrity index.

Optional: SIEM/correlation module labs — no refused technique files.

Command guide

Try these commands — Pack contents

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Evidence pack — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/ SANS — https://www.sans.org/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
python3 - <<'PY'
import os
lab = os.environ.get('HUNT_LAB', os.path.expanduser('~/cyberlium-lab/t30-hunt'))
path = os.path.join(lab, 'hunt', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
  'CAPSTONE EVIDENCE INDEX — YOUR lab only',
  'Telemetry: logs/process.jsonl, netflow.jsonl, auth.jsonl, alerts.json',
  'Hunt: hunt/hunt-hypothesis.md, technique-hypotheses.md, attack-map-lab.txt',
  'SIEM: spl-literacy-cheatsheet.txt, elk-literacy-cheatsheet.txt, kql-jq-bridge.md',
  'Correlation: hunt/correlation-notes.md, dashboards/dashboard-checklist.md',
  'IR: ir/picerl-checklist.md, containment-decision-tree.md, ir-timeline-LAB-IR-001.md',
  'PIR: pir/pir-template-LAB-IR-001.md, detection-gaps-LAB-IR-001.md, l3-handoff',
  'Refusals: no Impacket/Mimikatz/Cobalt, no stranger isolation, no malware payloads',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'Telemetry|IR:|Refusals' "$HUNT_LAB/hunt/capstone-evidence-index.txt"
grep LAB-IR "$HUNT_LAB/ir/containment-decision-tree.md"

Primary tools to practice this lesson: grep, python3. Reference sites: Evidence pack (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/); SANS (https://www.sans.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Index fields

Artifact name, module lesson, path, UTC date, description, redactions applied.

Checklist row ↔ index row accountability.

3. Integrity

$HUNT_LAB only, hunt/IR discipline, no unauthorized access, share-safe export.

Scan before seal — remove accidental prod paste or offensive scripts.

4. What you ship: SOC Level 2 & 3 evidence pack

Bundled deliverables + index + integrity — chmod 600, report not attacks default.

5. What you record before the next lesson

Evidence pack path.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Evidence pack includes lateral movement script and prod case export.
Right: Evidence pack assembled. Next: Capstone Lab.

Hands-on Exercise

Mission: assemble evidence pack

1) Bundle hunt IR containment eradication PIR index. 2) Integrity statements. 3) Confirm zero refused technique files. 4) Gap note for Topic 31 Cloud Security.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

Ask Mentor: “Minimum index rows for capstone?”

Practice QuizQuestion 1

Multiple choice

APPLY: Evidence pack includes:

Practice QuizQuestion 2

True or False

APPLY: True or False: Offensive playbooks OK in pack.

Practice QuizQuestion 3

Multiple choice

APPLY: Integrity line states: