Threat › Module 10 › Lesson 1
Checklist
Topic 33 capstone checklist — TI mindset, IOC/TTP, ATT&CK, feeds, platforms, collection, reporting on `$TI_LAB`.
Visual · t33_capstone_checklist
Checklist consolidates Threat Intelligence literacy pillars. $TI_LAB only. Original Cyberlium.
Opening
Capstone proves Threat Intelligence literacy on YOUR authorized `$TI_LAB` work — not marketplace ops or unauthorized prod access.
Assemble checklist covering Modules 1–9: TI mindset and lab scope, fundamentals and lifecycle, IOC/TTP literacy, ATT&CK structure and mapping, feeds STIX/TAXII quality, MISP/OpenCTI platform concepts, collection hygiene and dark-web capability literacy, analysis and reporting. Use on capstone walk of YOUR `$TI_LAB` — never marketplace how-tos, never unauthorized prod MISP/OpenCTI/SIEM, never corp mass-enum or doxxing, never prod paste without RoE. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab/t33-ti/. Integrity rows: `$TI_LAB` only, fictional stubs, no marketplace sources, limitations documented.
1. Scope and ethics
$TI_LAB named with RoE reference. NEVER marketplace how-tos, NEVER unauthorized prod tenant access, NEVER corp mass-enum, NEVER prod without ticket.
Dark-web monitoring = org capability/legal literacy — not criminal marketplace browsing.
Command guide
Try these commands — Scope and ethics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ CISA — https://www.cisa.gov/ MISP — https://www.misp-project.org/ FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/notes/capstone-checklist.txt" <<'EOF'
[ ] lab.env + notes/ iocs/ attack/ feeds/ platforms/ collection/ reports/ stix/
[ ] roe.txt + no-criminal-markets.txt reviewed
[ ] TI types + intel lifecycle + consumers named
[ ] iocs.json + iocs.csv with example.com/RFC1918/EICAR labels validated
[ ] ATT&CK matrix structure + tactics/techniques + subtechniques
[ ] mapping-threats-template + Navigator layer stub + coverage gaps
[ ] feed types + STIX/TAXII named + feed quality + fake STIX stub
[ ] MISP + OpenCTI named + platform ops checklist
[ ] OSINT hygiene + darkweb policy (authorized vendors / legal only)
[ ] analysis notes + TI report template + actionable intel checklist
[ ] never: buying access / carding forums / hacking forums howto / doxxing
EOFCommand — copy this
grep '\[ \]' "$TI_LAB/notes/capstone-checklist.txt"
python3 -c "print('Capstone: Threat Intelligence — YOUR t33-ti lab only')"Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); CISA (https://www.cisa.gov/); MISP (https://www.misp-project.org/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
IOC/TTP, ATT&CK, feeds, platforms, collection, reporting — linked rows.
Cross-link Topic 32 AI Security as separate track — unauthorized paths refused.
3. Teardown
Notes secured chmod 600, report pack ready, lab stubs archived per brief.
Retention note for mentor handoff.
4. What you ship: Topic 33 capstone checklist
One-page Threat Intelligence literacy capstone checklist for $TI_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'marketplace IOC ingest for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Marketplace browsing required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice