SOC › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 30 literacy evidence from $HUNT_LAB — hunt, IR, containment, eradication, PIR; no unauthorized access.
Visual · t30_evidence_pack
Evidence pack = mentor handoff from $HUNT_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered hunt notes — and never includes offensive playbooks or prod case exports.
Assemble evidence pack: $HUNT_LAB RoE, lab setup proof, hunting lab, ATT&CK lab, SIEM/correlation artifacts if brief assigned, IR lab, containment lab, eradication lab, PIR lab, integrity statement (authorized practice only, containment/eradication as defender decision literacy on lab host notes, no unauthorized prod IR, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + diagrams + hunt query stubs, not live attack scripts. Gap paragraph for Topic 31 Cloud Security — separate authorized track. Scan folder for lateral movement steps, malware source, prod case paste — zero tolerance.
1. Pack contents
Minimum: RoE, hunt, IR, containment, eradication, PIR, integrity index.
Optional: SIEM/correlation module labs — no refused technique files.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence pack — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/ SANS — https://www.sans.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
python3 - <<'PY'
import os
lab = os.environ.get('HUNT_LAB', os.path.expanduser('~/cyberlium-lab/t30-hunt'))
path = os.path.join(lab, 'hunt', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR lab only',
'Telemetry: logs/process.jsonl, netflow.jsonl, auth.jsonl, alerts.json',
'Hunt: hunt/hunt-hypothesis.md, technique-hypotheses.md, attack-map-lab.txt',
'SIEM: spl-literacy-cheatsheet.txt, elk-literacy-cheatsheet.txt, kql-jq-bridge.md',
'Correlation: hunt/correlation-notes.md, dashboards/dashboard-checklist.md',
'IR: ir/picerl-checklist.md, containment-decision-tree.md, ir-timeline-LAB-IR-001.md',
'PIR: pir/pir-template-LAB-IR-001.md, detection-gaps-LAB-IR-001.md, l3-handoff',
'Refusals: no Impacket/Mimikatz/Cobalt, no stranger isolation, no malware payloads',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'Telemetry|IR:|Refusals' "$HUNT_LAB/hunt/capstone-evidence-index.txt" grep LAB-IR "$HUNT_LAB/ir/containment-decision-tree.md"
Primary tools to practice this lesson: grep, python3. Reference sites: Evidence pack (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/); SANS (https://www.sans.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$HUNT_LAB only, hunt/IR discipline, no unauthorized access, share-safe export.
Scan before seal — remove accidental prod paste or offensive scripts.
4. What you ship: SOC Level 2 & 3 evidence pack
Bundled deliverables + index + integrity — chmod 600, report not attacks default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes lateral movement script and prod case export.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle hunt IR containment eradication PIR index. 2) Integrity statements. 3) Confirm zero refused technique files. 4) Gap note for Topic 31 Cloud Security.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Offensive playbooks OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice