Network Isolation Named

Network isolation literacy — VLAN segment, firewall deny, EDR network contain category — document isolating YOUR $HUNT_LAB host in notes.

Network Isolation Named• Audio Walkthrough

00:00/03:18

Visual · t30_network_isolation_named

Network isolation = named segment/contain rows. $HUNT_LAB host notes. Original Cyberlium.

Network isolation stops spread — name VLAN, firewall, and EDR contain vocabulary on YOUR lab host notes, not stranger network attack paths.

Network isolation literacy names: VLAN or subnet segmentation category, host firewall deny-outbound stub, NAC port disable category, EDR 'network contain' feature category, and DNS sinkhole category at literacy level. Analyst writes isolation plan for $HUNT_LAB labeled host (e.g., hunt-lab-vm-07) — documents intended effect (no outbound except jump box category), rollback note, UTC — without executing isolation on prod, without scanning or pivoting stranger networks, without disabling employer firewall for 'practice.' Cyberlium: isolate YOUR lab host in written runbook row — defender decision literacy only. Refused: unauthorized prod network changes, lateral movement to test isolation, MITM on live traffic. Lab row: isolation plan template (method, scope, rollback, UTC) filled for one lab host.

1. Isolation methods named

VLAN segment, firewall deny, NAC disable, EDR network contain, DNS sinkhole — five literacy anchors.

Method choice depends on asset criticality and available tooling — lab stub documents tradeoff.

Command guide

Try these commands — Isolation methods named

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Network isolation — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE T1071 — https://attack.mitre.org/techniques/T1071/ (C2 containment context) FIRST — https://www.first.org/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/ir/containment-decision-tree.md" <<'EOF'
# Containment Decision Tree — LAB scenario IDs ONLY
## LAB-IR-001 (jsmith / WIN-HUNT01 / 203.0.113.99)
```
Confirmed C2 beacon (HNT-003)?
  YES → Block 203.0.113.99 at perimeter (document rule)
       → Isolate WIN-HUNT01 to quarantine VLAN (YOUR lab VM)
       → Disable jsmith account (lab AD or doc)
  NO  → Continue monitoring, refine hunt hypothesis
## LAB-IR-002 (svc_backup / SMB lateral)
Confirmed unauthorized SMB (HNT-004)?
  YES → Disable svc_backup (lab doc)
       → Block 10.0.3.50→10.0.3.10:445 if unauthorized
  NO  → Verify change ticket, may be FP
```
NEVER: isolate stranger machines; NEVER: Impacket/Mimikatz/Cobalt recipes
All actions documented in markdown for YOUR lab VMs only
EOF

Command — copy this

grep -E 'LAB-IR|NEVER|203.0.113' "$HUNT_LAB/ir/containment-decision-tree.md"

Primary tools to practice this lesson: grep, python3. Reference sites: Network isolation (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE T1071 (https://attack.mitre.org/techniques/T1071/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Lab host note discipline

Write isolation plan for YOUR $HUNT_LAB host — label fictional hostname clearly.

Include rollback step — containment is not permanent by default.

3. Refused

No prod network isolation without RoE; no lateral movement to validate controls.

Isolation literacy supports defender response — not unauthorized network ops.

4. What you ship: network isolation plan row

Isolation method + lab host scope + rollback UTC + NEVER prod isolation without RoE line.

5. What you record before the next lesson

Network isolation plan row path.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Isolate random employer workstation without ticket as 'EDR practice.'
Right: Network isolation plan for $HUNT_LAB labeled host. Next: Account/Host Actions.

Hands-on Exercise