SOC › Module 10 › Lesson 1
Checklist
Topic 30 capstone checklist — hunt mindset, ATT&CK hunting, advanced SIEM, correlation, IR lifecycle, containment, eradication, PIR on $HUNT_LAB.
Visual · t30_capstone_checklist
Checklist consolidates SOC L2/L3 literacy pillars. $HUNT_LAB only. Original Cyberlium.
Opening
Capstone proves SOC L2/L3 literacy on YOUR authorized hunt-lab work — not unauthorized prod IR or offensive playbooks.
Assemble checklist covering Modules 1–9: L2 mindset and lab telemetry, threat hunting methodology, ATT&CK mapping, advanced SIEM literacy, correlation and dashboards, PICERL and IR roles, containment decision literacy, eradication and recovery, PIR and L3 handoff. Use on capstone walk of YOUR $HUNT_LAB — never unauthorized prod hunt or IR, never lateral movement or malware cookbooks, never prod containment without RoE, never validation fraud. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab. Integrity rows: $HUNT_LAB only, RoE stated, containment/eradication as defender decision literacy on lab host notes, limitations documented.
1. Scope and ethics
$HUNT_LAB named with RoE reference. NEVER unauthorized prod IR, NEVER offensive playbooks, NEVER prod containment without ticket, NEVER malware authoring.
Containment and eradication = isolate YOUR lab host in notes — defender vocabulary only.
Command guide
Try these commands — Scope and ethics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
SOC L2/L3 capstone — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE ATT&CK — https://attack.mitre.org/ Sigma — https://sigmahq.io/ Elastic — https://www.elastic.co/guide/en/security/current/index.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/hunt/capstone-checklist.txt" <<'EOF'
[ ] lab.env + logs/ hunt/ ir/ dashboards/ pir/ dirs
[ ] roe.txt + no-offensive-playbooks.txt reviewed
[ ] process.jsonl + netflow.jsonl + auth.jsonl + alerts.json seeded (FAKE)
[ ] hunt-hypothesis.md + technique-hypotheses.md written
[ ] jq/python3: rare parent + failed-then-success queries
[ ] SPL/KQL literacy cheatsheets + kql-jq-bridge.md
[ ] correlation-notes.md + dashboard-checklist.md
[ ] PICERL checklist + containment decision tree (LAB IDs only)
[ ] eradication + recovery + validation docs for LAB-IR-001
[ ] PIR template + detection gaps + L3 handoff
[ ] never: Impacket/Mimikatz/Cobalt / stranger isolation / malware payloads
EOFCommand — copy this
grep '\[ \]' "$HUNT_LAB/hunt/capstone-checklist.txt"
python3 -c "print('Capstone: SOC L2/L3 hunt + IR literacy — YOUR t30-hunt lab only')"Primary tools to practice this lesson: grep, python3. Reference sites: SOC L2/L3 capstone (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Elastic (https://www.elastic.co/guide/en/security/current/index.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
Hunt, ATT&CK, SIEM, correlation, PICERL, containment, eradication, PIR — linked rows.
Cross-link Topic 29 SOC L1 as prerequisite track — separate unauthorized paths refused.
3. Teardown
Notes secured chmod 600, report pack ready, lab telemetry exports archived optional per brief.
Archive retention note for mentor handoff.
4. What you ship: Topic 30 capstone checklist
One-page SOC Level 2 & 3 literacy capstone checklist for $HUNT_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'lateral movement playbook for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Offensive playbooks required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice