SOC › Module 6 › Lesson 2
Roles in IR
IR roles literacy — IR lead, L2 analyst, L3/forensics, comms, legal, management — on $HUNT_LAB tabletop stubs.
Visual · t30_roles_in_ir
IR roles = named responsibility rows. $HUNT_LAB. Original Cyberlium.
Opening
Incidents need owners — name IR roles on YOUR tabletop stub before anyone confuses hunt analyst with comms lead.
IR roles literacy names: IR lead (coordination, severity calls), L2 hunt/respond analyst (telemetry, containment recommendations on lab notes), L3/forensics (deep dive, evidence handling), comms/PR (stakeholder updates category), legal/compliance (notification category), executive sponsor (resource decisions). Analyst assigns $HUNT_LAB tabletop scenario roles — documents RACI-style rows at literacy level — without impersonating legal, without unauthorized prod executive pages, without solo 'hero' response skipping handoffs. Cyberlium teaches professional role boundaries aligned Module 9 L3 handoff. Refused: unauthorized prod comms, blaming roles in notes, executing forensics on stranger systems. Lab row: six roles with one responsibility and one boundary each.
1. Named IR roles
IR lead, L2 analyst, L3/forensics, comms, legal, exec — six literacy anchors.
Role clarity prevents duplicate work and missed notifications.
Command guide
Try these commands — Named IR roles
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
IR roles — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST CSIRT — https://www.first.org/global-society/teams SANS — https://www.sans.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
python3 - <<'PY'
roles = ['L2 Analyst: deep dive, correlation, containment rec', 'L3: hunt lead, rule tuning, forensics coord', 'IR Lead: PICERL orchestration, comms', 'Management: breach notification decisions']
print('IR roles for LAB-IR-001 (YOUR lab):')
for r in roles: print(f' - {r}')
PYCommand — copy this
cat > "$HUNT_LAB/ir/roles-lab-ir-001.txt" <<'EOF' LAB-IR-001 role assignments (literacy): L2: correlate HNT-001/002/003, draft containment rec L3: validate hunt hypothesis, tune detection gaps IR Lead: PICERL checklist, stakeholder comms template Legal/Comms: notification decision (lab doc only) EOF
Command — copy this
grep L2 "$HUNT_LAB/ir/roles-lab-ir-001.txt"
Primary tools to practice this lesson: python3, grep. Reference sites: IR roles (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST CSIRT (https://www.first.org/global-society/teams); SANS (https://www.sans.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. L2 analyst boundary
L2 recommends containment options — executes only within RoE on authorized lab hosts.
Escalate to L3 when forensics scope exceeds lab stub — link Module 9-3.
3. Refused
No unauthorized prod executive or legal comms; no forensics on stranger assets.
Role literacy supports coordination — not authority impersonation.
4. What you ship: IR roles table
Six roles + responsibility + boundary each + NEVER unauthorized prod comms line.
5. What you record before the next lesson
IR roles table path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Send unauthorized 'incident notification' email to employer customers as tabletop practice.
Right
IR roles table from $HUNT_LAB tabletop stub. Next: Evidence Hygiene.
Mission: IR roles table
1) List six IR roles. 2) One responsibility and boundary per role. 3) Assign roles to lab tabletop scenario. 4) Write NEVER unauthorized prod comms line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “L2 vs L3 — when forensics handoff?”
Knowledge Check
APPLY: IR roles literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized prod incident emails are lab.
True or False
Knowledge Check
APPLY: L2 analyst typically:
Multiple choice