SOC › Module 10 › Lesson 2
Lab Path
SOC Level 2 & 3 literacy path on $HUNT_LAB — hunt telemetry to mentor handoff with ethics gates at every station.
Visual · t30_lab_path
Lab path = visual hunt/IR chain on YOUR $HUNT_LAB. Original Cyberlium.
Opening
Draw the path from lab scope to mentor handoff — with stop signs at every unauthorized prod IR and offensive shortcut.
Document literacy path: $HUNT_LAB setup → hunt methodology → ATT&CK mapping → advanced SIEM → correlation → PICERL IR → containment decisions → eradication/recovery → PIR/L3 handoff → capstone. Ethics gates: unauthorized prod hunt/IR, lateral movement, malware authoring, prod containment, validation fraud, prod L3 page — refused paths labeled red. UTC milestones and artifact IDs per station. Mermaid or sketch chmod 600. Honest N/A if brief skipped live SIEM hunt — labeled. Defender breakpoint: where RoE or hunt discipline prevented out-of-scope test.
1. Path stations
Setup, hunt, ATT&CK, SIEM, correlation, PICERL, containment, eradication, PIR, handoff — ten minimum stations.
Each station links evidence index row and module lesson ID.
Command guide
Try these commands — Path stations
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE — https://attack.mitre.org/ Splunk — https://docs.splunk.com/ Elastic — https://www.elastic.co/guide/en/security/current/index.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install curl
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
echo '=== Capstone path: hunt → correlate → IR ==='
jq '.[] | select(.id=="HNT-002")' "$HUNT_LAB/logs/alerts.json"
jq -c 'select(.parent=="winword.exe")' "$HUNT_LAB/logs/process.jsonl"
jq -c 'select(.dst_ip=="203.0.113.99")' "$HUNT_LAB/logs/netflow.jsonl"
curl -sS https://attack.mitre.org/techniques/T1110/001/ | head -8Primary tools to practice this lesson: jq, curl. Reference sites: MITRE (https://attack.mitre.org/); Splunk (https://docs.splunk.com/); Elastic (https://www.elastic.co/guide/en/security/current/index.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics overlay
Red stops: unauthorized prod IR, offensive playbooks, prod containment, validation fraud.
RoE branch always green start — sample telemetry on separate labeled branch.
3. Integrity breakpoint
Mark where scope check or hunt discipline prevented out-of-RoE test.
One paragraph uplift from YOUR $HUNT_LAB path.
4. What you ship: lab path diagram
Hunt/IR chain with ethics gates + UTC milestones — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Lab path includes lateral movement shortcut lane.
Right
Lab path documented for $HUNT_LAB. Next: Evidence Pack.
Mission: lab path diagram
1) Map ten stations. 2) Add six ethics gates. 3) UTC milestones per station. 4) Link evidence index IDs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
Knowledge Check
APPLY: Lab path documents:
Multiple choice
Knowledge Check
APPLY: True or False: Offensive shortcut OK on path.
True or False
Knowledge Check
APPLY: Path ends at:
Multiple choice