SOC › Module 6 › Lesson 4
Lab — IR
IR lifecycle lab on $HUNT_LAB — PICERL map, roles table, evidence card from hunt incident stub.
Visual · t30_ir_lab
Lab: IR lifecycle pack on YOUR $HUNT_LAB incident stub. Original Cyberlium.
Opening
Ship IR lifecycle artifacts from YOUR hunt incident stub — PICERL, roles, evidence — zero unauthorized prod response or attack repro.
On YOUR $HUNT_LAB per brief: (1) scope proof — incident stub name and hunt telemetry source labeled; (2) PICERL map with six stages and checkpoints tied to hunt findings; (3) IR roles table with tabletop assignments; (4) evidence hygiene card on one artifact with chain row; (5) UTC timeline stub separating observed vs inferred; (6) integrity block — $HUNT_LAB only, no unauthorized prod IR, no lateral movement or malware repro; (7) chmod 600 pack. Cross-link Modules 2–5 hunt work — professional IR literacy, not offensive cookbooks.
1. Lab deliverables
PICERL + roles + evidence cross-indexed to one incident stub.
Timeline cites hunt query hits — not fabricated narrative.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST IR — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final Elastic timeline — https://www.elastic.co/guide/en/security/current/timeline.html Splunk ES — https://docs.splunk.com/Documentation/ES
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/ir/ir-timeline-LAB-IR-001.md" <<'EOF'
# IR Timeline — LAB-IR-001 (YOUR seeded logs)
| UTC | Event | Source | MITRE |
|---|---|---|---|
| 04:10:01Z | 4625 failure jsmith | auth.jsonl | T1110.001 |
| 04:10:22Z | 4624 success jsmith | auth.jsonl | T1078 |
| 04:11:15Z | winword→powershell | process.jsonl | T1059.001 |
| 04:11:30Z | HTTPS to 203.0.113.99 | netflow.jsonl | T1071.001 |
| 04:12:00Z | Alerts HNT-001/002/003 | alerts.json | — |
Scope: FAKE lab telemetry — identification phase complete
EOFCommand — copy this
jq '.[] | select(.scenario=="LAB-IR-001") | {id, title, mitre}' "$HUNT_LAB/logs/alerts.json"
grep -E '04:10|04:11|LAB-IR' "$HUNT_LAB/ir/ir-timeline-LAB-IR-001.md"═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t30-hunt/ir/picerl-checklist.md | Select-String Containment Get-Content $HOME/cyberlium-lab/t30-hunt/ir/ir-timeline-LAB-IR-001.md | Select-String 04:11
Primary tools to practice this lesson: grep, jq. Reference sites: NIST IR (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Elastic timeline (https://www.elastic.co/guide/en/security/current/timeline.html); Splunk ES (https://docs.splunk.com/Documentation/ES). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Label synthetic vs sample sources; redact PII in share-safe copy.
Hash stub on lab export — custody row complete.
3. Teardown
Secure notes chmod 600; no lab IR actions pushed to prod ticketing without approval.
Archive stub optional per brief.
4. What you ship: IR lab pack
PICERL + roles + evidence + timeline + integrity — chmod 600.
5. What you record before the next lesson
IR lab pack path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
IR lab includes lateral movement walkthrough against employer VLAN.
Right
IR lab pack on $HUNT_LAB incident stub. Next: quiz.
Mission: IR lab
1) Scope and incident stub proof. 2) PICERL map and roles table. 3) Evidence card with chain row. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum timeline entries if brief sparse?”
Knowledge Check
APPLY: IR lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Attack repro belongs in IR lab.
True or False
Knowledge Check
APPLY: PICERL map should:
Multiple choice