SOC › Module 9 › Lesson 1
PIR Lessons
PIR literacy — post-incident review, lessons learned, action items — on $HUNT_LAB closed incident stub.
Visual · t30_pir_lessons
PIR = named lessons-learned rows. $HUNT_LAB. Original Cyberlium.
Opening
Incidents teach if you capture lessons — name PIR structure on YOUR closed lab stub before repeating the same hunt misses.
Post-Incident Review (PIR) literacy names: review participants category, timeline reconstruction UTC, what worked / what failed rows, root cause category (misconfig, stolen creds category — literacy not blame), action items with owners, and lessons learned summary for detection/engineering. Analyst drafts PIR outline on $HUNT_LAB closed incident from Modules 6–8 — cites PICERL Lessons Learned stage — without blaming individuals inappropriately, without unauthorized prod PIR publication, without hiding containment delays. Cyberlium teaches constructive defender retrospective on lab stubs. Refused: public shaming in PIR, prod PIR without RoE, skipping action items. Lab row: PIR template (participants, timeline, worked/failed, actions) filled for one lab incident.
1. PIR structure named
Participants, timeline, worked/failed, root cause category, action items — five literacy sections.
PIR closes PICERL Lessons Learned — feeds detection gaps Module 9-2.
Command guide
Try these commands — PIR structure named
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
PIR template — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final SANS post-incident — https://www.sans.org/white-papers/incident-handlers-handbook/ FIRST — https://www.first.org/resources/guides/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/pir/pir-template-LAB-IR-001.md" <<'EOF'
# Post-Incident Review (PIR) — LAB-IR-001
## Incident summary
- Scenario ID: LAB-IR-001
- Timeline: see ir/ir-timeline-LAB-IR-001.md
- Impact: jsmith account compromise, C2 beacon (FAKE lab data)
## What happened
- Failed-then-success logon from 203.0.113.77
- winword→powershell execution chain
- Periodic HTTPS to 203.0.113.99
## What went well
- Hunt hypothesis validated across auth/process/netflow
- Correlation of HNT-001/002/003
## What needs improvement
- Detection gap: beacon ran 3 intervals before alert
- Tuning: add parent process allowlist exceptions
## Action items
- [ ] Deploy tuned sigma rule for rare parent
- [ ] Add dashboard panel for failed-then-success
- [ ] Tabletop exercise for containment decision tree
## Scope statement
- Authorized lab exercise only — YOUR seeded telemetry
EOFCommand — copy this
grep -E 'PIR|Action items|Scope' "$HUNT_LAB/pir/pir-template-LAB-IR-001.md"
Primary tools to practice this lesson: grep, python3. Reference sites: PIR template (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS post-incident (https://www.sans.org/white-papers/incident-handlers-handbook/); FIRST (https://www.first.org/resources/guides/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Constructive tone
Focus on process and controls — not personal blame in lab notes.
Action items SMART at category level (owner, due stub, priority).
3. Refused
No unauthorized prod PIR publish; no fabricated lessons.
PIR literacy supports improvement — not cover-ups.
4. What you ship: PIR outline template
PIR five sections + one completed lab incident + NEVER blame-only line.
5. What you record before the next lesson
PIR outline template path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish unauthorized prod PIR naming coworkers as 'at fault' on social media.
Right
PIR outline from $HUNT_LAB closed incident. Next: Detection Gaps.
Mission: PIR outline template
1) List five PIR sections. 2) Fill outline for one lab incident. 3) Three action items with owners. 4) Write constructive tone note.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Worked vs failed — minimum rows?”
Knowledge Check
APPLY: PIR literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Public shaming in PIR is lab.
True or False
Knowledge Check
APPLY: PIR action items should:
Multiple choice