Mod 10 · Les 3/5

Learn›Threat Intelligence›Module 10›Lesson 3

In progress

Module 10•Lesson 3 of 5•⏱️ 15 min read•Beginner+40 XP

Evidence Pack

Bundle Topic 33 literacy evidence from `$TI_LAB` — feeds, platforms, collection, reporting; no marketplace refs.

Evidence Pack• Audio Walkthrough

00:00/02:46

Visual · t33_evidence_pack

Evidence pack = mentor handoff from $TI_LAB literacy. Original Cyberlium.

One indexed pack beats scattered TI notes — and never includes marketplace how-tos or unauthorized prod exports.

Assemble evidence pack: `$TI_LAB` RoE, lab setup proof, IOC/ATT&CK labs if brief assigned, feeds lab, platforms lab, collection lab, reporting lab, integrity statement (fictional stubs only, no marketplace sources, no unauthorized prod access, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + yaml stubs + diagrams, not marketplace guides. Gap paragraph for Topic 34 Incident Response — separate authorized track. Scan folder for marketplace refs, prod keys, victim PII — zero tolerance.

1. Pack contents

Minimum: RoE, feeds, platforms, collection, reporting, integrity index.

Optional: IOC/ATT&CK module labs — no refused technique files.

Command guide

Try these commands — Pack contents

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

MITRE ATT&CK — https://attack.mitre.org/ CISA — https://www.cisa.gov/ OpenCTI — https://github.com/OpenCTI-Platform/opencti

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
python3 - <<'PY'
import os
lab = os.environ.get('TI_LAB', os.path.expanduser('~/cyberlium-lab/t33-ti'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
  'CAPSTONE EVIDENCE INDEX — YOUR t33-ti lab only',
  'Ethics: roe.txt, no-criminal-markets.txt, darkweb-policy-note.txt, legal-ethics.txt',
  'Fundamentals: intel-lifecycle.md, intel-consumers-named.txt',
  'IOCs: iocs.json, iocs.csv (example.com/RFC1918/EICAR) + python3 validation',
  'ATT&CK: matrix-structure, tactics-techniques, subtechniques, mapping template',
  'Navigator: navigator-named.txt, navigator-layer-stub.json, coverage-gaps',
  'Feeds: feed-types, stix-taxii-named, feed-quality-checklist, fake-indicator-stub.json',
  'Platforms: misp-named, opencti-named, platform-ops-checklist',
  'Collection: osint-hygiene, darkweb policy (authorized vendors / legal only)',
  'Reports: analysis-notes-template, ti-report-template, lab-campaign-report.md',
  'Refusals: no buying access / carding / hacking forums howto / doxxing',
]))
print(f'Wrote {path}')
PY

Command — copy this

grep -E 'IOCs:|Refusals|darkweb policy' "$TI_LAB/notes/capstone-evidence-index.txt"

Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); CISA (https://www.cisa.gov/); OpenCTI (https://github.com/OpenCTI-Platform/opencti). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Index fields

Artifact name, module lesson, path, UTC date, description, redactions applied.

Checklist row ↔ index row accountability.

3. Integrity

$TI_LAB only, fictional stubs discipline, no marketplace refs, share-safe export.

Scan before seal — remove accidental prod keys or marketplace notes.

4. What you ship: Threat Intelligence evidence pack

Bundled deliverables + index + integrity — chmod 600, report not marketplace guides default.

5. What you record before the next lesson

Evidence pack path.

6. Wrong vs right: criminal markets vs YOUR lab IOCs

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Evidence pack includes marketplace browsing guide and unauthorized prod MISP export.
Right: Evidence pack assembled. Next: Capstone Lab.

Hands-on Exercise

Mission: assemble evidence pack

1) Bundle feeds platforms collection reporting index. 2) Integrity statements. 3) Confirm zero marketplace refs. 4) Gap note for Topic 34 Incident Response.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

Ask Mentor: “Minimum index rows for capstone?”

Practice QuizQuestion 1

Multiple choice

APPLY: Evidence pack includes:

Practice QuizQuestion 2

True or False

APPLY: True or False: Marketplace guides OK in pack.

Practice QuizQuestion 3

Multiple choice

APPLY: Integrity line states: