SOC › Module 7 › Lesson 1
Containment Options
Containment options literacy — network isolation, account disable, host quarantine categories — defender decision vocabulary on YOUR $HUNT_LAB host notes.
Visual · t30_containment_options
Containment options = named defender decisions. $HUNT_LAB host notes. Original Cyberlium.
Opening
Containment limits damage — learn named options and tradeoffs on YOUR lab host notes, never attacker lateral-movement how-tos.
Containment options literacy names defender choices: network isolation (segment lab host — Module 7-2), account disable/reset (Module 7-3), host quarantine via EDR category, temporary firewall deny rule category, and watch-only when scope uncertain. Analyst documents containment decision matrix on $HUNT_LAB synthetic compromised-host stub — cites hunt findings, lists pros/cons, selects recommended option for lab scenario — without isolating prod systems without RoE, without writing lateral movement scripts, without malware deployment to 'prove' containment need. Cyberlium teaches decision literacy: isolate YOUR lab host in notes — NOT how to spread or persist on stranger networks. Refused: prod containment without ticket, attack repro, disabling security controls on employer assets. Lab row: four containment options with decision criteria each.
1. Named containment options
Network isolate, account action, host quarantine, firewall deny, watch-only — five literacy anchors.
Decision matrix weighs blast radius vs business impact — even on lab stubs.
Command guide
Try these commands — Named containment options
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Containment options — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final NIST containment — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final SANS IR — https://www.sans.org/white-papers/incident-handlers-handbook/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
python3 - <<'PY'
options = ['Network: block dst 203.0.113.99 at perimeter (lab doc)', 'Host: isolate WIN-HUNT01 VLAN (YOUR lab VM only)', 'Account: disable jsmith pending reset (lab scenario)', 'Monitoring: increase logging on WIN-HUNT02']
print('Containment options literacy (LAB scenario IDs only):')
for o in options: print(f' - {o}')
PYCommand — copy this
cat > "$HUNT_LAB/ir/containment-options.txt" <<'EOF' Containment options for LAB-IR-001 / LAB-IR-002: Network block: 203.0.113.99 (document firewall rule — lab only) Host isolation: WIN-HUNT01 (YOUR lab VM — never stranger machines) Account: disable jsmith, force password reset (lab playbook) Preserve: snapshot VM before changes for eradication phase HARD BAN: live isolation of stranger/production machines without authorization EOF
Command — copy this
grep -E 'LAB-IR|HARD BAN|YOUR lab' "$HUNT_LAB/ir/containment-options.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: Containment options (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); NIST containment (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS IR (https://www.sans.org/white-papers/incident-handlers-handbook/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Decision literacy
Containment follows confirmed scope from PICERL Identification — not panic.
Document chosen option and rejected alternatives with UTC.
3. $HUNT_LAB boundary
Containment notes reference YOUR lab host stub — not unauthorized prod isolation.
Refused: lateral movement, malware deploy, prod EDR disable.
4. What you ship: containment options matrix
Four options + decision criteria + lab host recommendation + NEVER attack repro line.
5. What you record before the next lesson
Containment options matrix path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deploy malware on lab network then 'contain' by attacking other hosts.
Right
Containment options matrix from $HUNT_LAB host stub. Next: Network Isolation Named.
Mission: containment options matrix
1) Name four containment options. 2) Decision criteria per option. 3) Recommend one for lab host stub. 4) Write NEVER attack repro line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Watch-only — when scope uncertain?”
Knowledge Check
APPLY: Containment literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Malware deployment to practice containment is lab.
True or False
Knowledge Check
APPLY: Containment decision should:
Multiple choice