SOC › Module 7 › Lesson 2
Network Isolation Named
Network isolation literacy — VLAN segment, firewall deny, EDR network contain category — document isolating YOUR $HUNT_LAB host in notes.
Visual · t30_network_isolation_named
Network isolation = named segment/contain rows. $HUNT_LAB host notes. Original Cyberlium.
Opening
Network isolation stops spread — name VLAN, firewall, and EDR contain vocabulary on YOUR lab host notes, not stranger network attack paths.
Network isolation literacy names: VLAN or subnet segmentation category, host firewall deny-outbound stub, NAC port disable category, EDR 'network contain' feature category, and DNS sinkhole category at literacy level. Analyst writes isolation plan for $HUNT_LAB labeled host (e.g., hunt-lab-vm-07) — documents intended effect (no outbound except jump box category), rollback note, UTC — without executing isolation on prod, without scanning or pivoting stranger networks, without disabling employer firewall for 'practice.' Cyberlium: isolate YOUR lab host in written runbook row — defender decision literacy only. Refused: unauthorized prod network changes, lateral movement to test isolation, MITM on live traffic. Lab row: isolation plan template (method, scope, rollback, UTC) filled for one lab host.
1. Isolation methods named
VLAN segment, firewall deny, NAC disable, EDR network contain, DNS sinkhole — five literacy anchors.
Method choice depends on asset criticality and available tooling — lab stub documents tradeoff.
Command guide
Try these commands — Isolation methods named
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Network isolation — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE T1071 — https://attack.mitre.org/techniques/T1071/ (C2 containment context) FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/ir/containment-decision-tree.md" <<'EOF'
# Containment Decision Tree — LAB scenario IDs ONLY
## LAB-IR-001 (jsmith / WIN-HUNT01 / 203.0.113.99)
```
Confirmed C2 beacon (HNT-003)?
YES → Block 203.0.113.99 at perimeter (document rule)
→ Isolate WIN-HUNT01 to quarantine VLAN (YOUR lab VM)
→ Disable jsmith account (lab AD or doc)
NO → Continue monitoring, refine hunt hypothesis
## LAB-IR-002 (svc_backup / SMB lateral)
Confirmed unauthorized SMB (HNT-004)?
YES → Disable svc_backup (lab doc)
→ Block 10.0.3.50→10.0.3.10:445 if unauthorized
NO → Verify change ticket, may be FP
```
NEVER: isolate stranger machines; NEVER: Impacket/Mimikatz/Cobalt recipes
All actions documented in markdown for YOUR lab VMs only
EOFCommand — copy this
grep -E 'LAB-IR|NEVER|203.0.113' "$HUNT_LAB/ir/containment-decision-tree.md"
Primary tools to practice this lesson: grep, python3. Reference sites: Network isolation (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE T1071 (https://attack.mitre.org/techniques/T1071/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab host note discipline
Write isolation plan for YOUR $HUNT_LAB host — label fictional hostname clearly.
Include rollback step — containment is not permanent by default.
3. Refused
No prod network isolation without RoE; no lateral movement to validate controls.
Isolation literacy supports defender response — not unauthorized network ops.
4. What you ship: network isolation plan row
Isolation method + lab host scope + rollback UTC + NEVER prod isolation without RoE line.
5. What you record before the next lesson
Network isolation plan row path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Isolate random employer workstation without ticket as 'EDR practice.'
Right
Network isolation plan for $HUNT_LAB labeled host. Next: Account/Host Actions.
Mission: network isolation plan row
1) Name three isolation methods. 2) Fill plan template for one lab host. 3) Write rollback step UTC. 4) Write NEVER unauthorized prod isolation line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “EDR network contain — literacy vs full NAC?”
Knowledge Check
APPLY: Network isolation literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Prod isolation without RoE is lab.
True or False
Knowledge Check
APPLY: Isolation plan should include:
Multiple choice