SOC › Module 7 › Lesson 4
Lab — Containment
Containment lab on $HUNT_LAB — options matrix, isolation plan, account/host checklist from incident stub.
Visual · t30_containment_lab
Lab: containment pack on YOUR $HUNT_LAB host notes. Original Cyberlium.
Opening
Ship containment decision artifacts from YOUR lab host stub — options, isolation, account actions — zero prod changes or attack repro.
On YOUR $HUNT_LAB per brief: (1) scope proof — labeled lab host and hunt finding linked; (2) containment options matrix with recommendation; (3) network isolation plan row with rollback; (4) account/host action checklist with sequencing; (5) UTC decision summary separating observed vs inferred; (6) integrity — $HUNT_LAB notes only, isolate YOUR lab host in documentation, no unauthorized prod containment, no lateral movement or malware; (7) chmod 600 pack. Containment = defender decision literacy — document what you would do and why on authorized lab stubs.
1. Lab deliverables
Options matrix + isolation plan + account/host checklist — single lab host cross-index.
Decision summary cites PICERL Containment stage from Module 6.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Containment playbook — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final SANS — https://www.sans.org/ FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
python3 - <<'PY'
import os
lab = os.environ.get('HUNT_LAB', os.path.expanduser('~/cyberlium-lab/t30-hunt'))
path = os.path.join(lab, 'ir', 'containment-log-LAB-IR-001.md')
open(path, 'w').write('
'.join([
'# Containment Log — LAB-IR-001 (YOUR lab)',
'## Actions taken (documented — lab VMs only)',
' - [x] Block 203.0.113.99 at perimeter (simulated firewall rule)',
' - [x] Isolate WIN-HUNT01 to quarantine VLAN (YOUR lab VM)',
' - [x] Disable jsmith account (lab AD doc)',
'## Rationale',
' - HNT-002 failed-then-success + HNT-003 C2 beacon confirmed',
'## Refusals',
' - No stranger machine isolation; no Impacket/Mimikatz/Cobalt recipes',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'LAB-IR|Refusals|203.0.113' "$HUNT_LAB/ir/containment-log-LAB-IR-001.md" grep LAB-IR "$HUNT_LAB/ir/containment-decision-tree.md"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t30-hunt/ir/containment-decision-tree.md | Select-String LAB-IR Get-Content $HOME/cyberlium-lab/t30-hunt/ir/containment-log-LAB-IR-001.md | Select-String Refusals
Primary tools to practice this lesson: grep, python3. Reference sites: Containment playbook (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS (https://www.sans.org/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each row cites hunt telemetry stub — not guessed attacker narrative.
Zero offensive steps in any artifact — decision literacy only.
3. Integrity
Prod isolation or account disable without RoE = zero credit.
Mentor pack chmod 600.
4. What you ship: containment lab pack
Matrix + isolation + account/host + decision summary + integrity — chmod 600.
5. What you record before the next lesson
Containment lab pack path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Containment lab includes lateral movement script as 'validation.'
Right
Containment lab pack on $HUNT_LAB host notes. Next: quiz.
Mission: containment lab
1) Scope and lab host proof. 2) Options matrix and isolation plan. 3) Account/host checklist. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Rollback note — minimum fields?”
Knowledge Check
APPLY: Containment lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Attack repro belongs in containment lab.
True or False
Knowledge Check
APPLY: Containment lab teaches:
Multiple choice