Threat › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on `$TI_LAB` — checklist, lab path, evidence pack sealed; zero marketplace refs.
Visual · t33_capstone_lab
Capstone: checklist × $TI_LAB literacy evidence. Original Cyberlium.
Opening
Close the Threat Intelligence literacy loop — feeds cataloged, platforms sketched, collection governed, report shipped — without marketplace ops or unauthorized prod access.
Walk Topic 33 checklist on YOUR `$TI_LAB`: verify RoE, lab path current, feeds/platforms/collection/reporting packs indexed, scan for marketplace refs and unauthorized prod notes (must be zero). Update index with capstone UTC completion. Integrity paragraph: fictional stub discipline and collection RoE key insight from YOUR path. No marketplace how-tos, no unauthorized prod MISP/OpenCTI/SIEM, no corp mass-enum, no prod paste without RoE. Optional mentor review — three clarity questions. Secure notes chmod 600 after if brief requires.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero marketplace refs in any file.
Scan sealed pack for unauthorized prod URLs — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ MISP — https://www.misp-project.org/ CISA — https://www.cisa.gov/ OpenCTI — https://docs.opencti.io/latest/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
grep NEVER "$TI_LAB/notes/no-criminal-markets.txt"
grep -E 'HARD BAN|authorized vendors' "$TI_LAB/collection/darkweb-policy-note.txt" "$TI_LAB/collection/legal-ethics.txt"
echo '=== Capstone: fake IOCs → ATT&CK map → STIX stub → feeds → platforms → report ==='
python3 - <<'PY'
import json, os
lab = os.environ.get('TI_LAB', os.path.expanduser('~/cyberlium-lab/t33-ti'))
n = len(json.load(open(os.path.join(lab,'iocs','iocs.json')))['indicators'])
print(f'Validated fake IOC count: {n}')
PYCommand — copy this
grep -E 'T1566|T1071' "$TI_LAB/reports/lab-campaign-report.md"
grep '\[ \]' "$TI_LAB/notes/capstone-checklist.txt" | head -5
python3 - <<'PY'
import os
lab = os.environ.get('TI_LAB', os.path.expanduser('~/cyberlium-lab/t33-ti'))
path = os.path.join(lab, 'notes', 'capstone-summary.txt')
open(path, 'w').write('
'.join([
'Threat Intelligence Capstone',
'scope: YOUR $HOME/cyberlium-lab/t33-ti/ + fake IOCs only',
'iocs: example.com, RFC1918, EICAR hash labels — python3/jq validated',
'attack: matrix literacy + mapping + Navigator layer stub',
'feeds: STIX/TAXII concepts + feed quality + fake STIX bundle',
'platforms: MISP + OpenCTI named + ops checklist',
'collection: OSINT hygiene + darkweb authorized-vendor policy only',
'reports: analysis template + TI report + actionable intel checklist',
'never: buying access / carding forums / hacking forums howto / doxxing',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'scope|never|fake IOCs' "$TI_LAB/notes/capstone-summary.txt"
═══ WINDOWS ═══
Capstone on YOUR lab Windows VM only
Command — copy this
Get-Content $HOME/cyberlium-lab/t33-ti/notes/no-criminal-markets.txt | Select-String NEVER Get-Content $HOME/cyberlium-lab/t33-ti/notes/capstone-summary.txt | Select-String never Get-Content $HOME/cyberlium-lab/t33-ti/iocs/iocs.csv | Select-String example.com
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); MISP (https://www.misp-project.org/); CISA (https://www.cisa.gov/); OpenCTI (https://docs.opencti.io/latest/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Integrity paragraph
RoE + fictional stubs + collection hygiene key → professional handoff idea from YOUR lab path.
Name what breaks if you skip scope or ingest marketplace sources — ethics tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 34 Incident Response on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + integrity paragraph + zero marketplace scan.
5. What you record before the next lesson
Capstone pack path. $TI_LAB quiet.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes marketplace IOC ingest walkthrough as bonus exhibit.
Right
Capstone complete on $TI_LAB with full teardown. Next: topic quiz.
Mission: Topic 33 capstone
1) Walk checklist with evidence links. 2) Integrity paragraph from your path. 3) Seal pack — zero marketplace refs. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Marketplace browsing earns capstone credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice