Lab — Reporting
Reporting lab on `$TI_LAB` — analysis notes, TI report outline, actionable recommendations bundled.
Visual · t33_reporting_lab
Lab: reporting pack from YOUR $TI_LAB analysis artifacts. Original Cyberlium.
Ship professional TI reporting artifacts from YOUR lab stubs — notes, report, recommendations — zero marketplace claims or unauthorized prod actions.
From `$TI_LAB` labs Modules 6–8: (1) report cover — scope, RoE, analyst, UTC; (2) analysis notes template Module 9-1; (3) TI report outline Module 9-2; (4) actionable recommendations Module 9-3; (5) ATT&CK mapping cross-link from Module 5; (6) limitations paragraph (lab vs prod, brief gaps); (7) integrity — `$TI_LAB` only, no marketplace-as-fact, no prod paste, no unauthorized block rules; (8) chmod 600 index.md. Professional tone — mentor-readable. Cross-link feeds, platforms, and collection packs.
1. Lab deliverables
Analysis notes + report outline + recommendations — single reporting thread.
Limitations paragraph mandatory — honest lab scope.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ CISA — https://www.cisa.gov/ OpenCTI reports — https://docs.opencti.io/latest/usage/reports/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
python3 - <<'PY'
import os
lab = os.environ.get('TI_LAB', os.path.expanduser('~/cyberlium-lab/t33-ti'))
report = os.path.join(lab, 'reports', 'lab-campaign-report.md')
open(report, 'w').write('
'.join([
'# Lab Campaign Report — Fake Phish Scenario',
'## IOCs (fake)',
'- phish-lab.example.com, 192.168.99.50, EICAR sha256 label',
'## ATT&CK',
'- T1566.002 Spearphishing Link',
'- T1071.001 Web C2',
'## Recommendations',
'- Test SIEM rule on example.com domain block in lab VLAN',
'- Import navigator-layer-stub.json into ATT&CK Navigator',
'## Integrity',
'- Synthetic data only; no real victims; no criminal collection',
]))
print(f'Wrote {report}')
PYCommand — copy this
grep -E 'T1566|Integrity|fake' "$TI_LAB/reports/lab-campaign-report.md" ls "$TI_LAB/reports/"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t33-ti/reports/ti-report-template.md | Select-String Executive
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); CISA (https://www.cisa.gov/); OpenCTI reports (https://docs.opencti.io/latest/usage/reports/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each finding traceable to Module 6–8 stub evidence row.
Zero marketplace references or unauthorized prod action notes.
3. Integrity scan
Scan for marketplace refs, prod paste, unvalidated block rules — zero hits.
Practice label if brief requires.
4. What you ship: reporting lab pack
Notes + report + recommendations + index + integrity — chmod 600.
5. What you record before the next lesson
Reporting lab pack path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Reporting lab includes marketplace leak as primary source and prod block instructions.
- Right: Reporting lab pack on `$TI_LAB`. Next: quiz.
Mission: reporting lab
1) Analysis notes complete. 2) Report outline seven sections. 3) Three actionable recommendations. 4) Integrity scan; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum sections if brief sparse?”
APPLY: Reporting lab includes:
APPLY: True or False: Hide limitations in reporting lab.
APPLY: Actionable intel disposition: