Threat › Module 10 › Lesson 2
Lab Path
Threat Intelligence literacy path on `$TI_LAB` — lab setup to mentor handoff with ethics gates at every station.
Visual · t33_lab_path
Lab path = visual TI chain on YOUR $TI_LAB. Original Cyberlium.
Opening
Draw the path from lab scope to mentor handoff — with stop signs at every marketplace shortcut and unauthorized prod access lane.
Document literacy path: `$TI_LAB` setup → fundamentals → IOC/TTP → ATT&CK mapping → feeds → platforms → collection hygiene → analysis/reporting → capstone. Ethics gates: marketplace how-tos, unauthorized prod MISP/OpenCTI/SIEM, corp mass-enum, doxxing, prod paste without RoE — refused paths labeled red. UTC milestones and artifact IDs per station. Mermaid or sketch chmod 600. Honest N/A if brief skipped live platform yaml — labeled. Defender breakpoint: where RoE or scope discipline prevented out-of-scope collection.
1. Path stations
Setup, fundamentals, IOC/TTP, ATT&CK, feeds, platforms, collection, reporting, handoff — nine minimum stations.
Each station links evidence index row and module lesson ID.
Command guide
Try these commands — Path stations
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ Navigator — https://mitre-attack.github.io/attack-navigator/ OASIS STIX — https://oasis-open.github.io/cti-documentation/stix/intro.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
echo '=== Capstone path: mindset → fundamentals → IOC/TTP → ATT&CK → mapping → feeds → platforms → collection → reporting ==='
grep -E 'example.com|RFC1918|EICAR' "$TI_LAB/iocs/iocs.json" "$TI_LAB/iocs/iocs.csv" | head -4
grep -E 'T1566|T1071' "$TI_LAB/attack/mapping-threats-template.md" "$TI_LAB/attack/navigator-layer-stub.json" | head -4
curl -sS https://attack.mitre.org/ | head -5Primary tools to practice this lesson: curl, grep. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Navigator (https://mitre-attack.github.io/attack-navigator/); OASIS STIX (https://oasis-open.github.io/cti-documentation/stix/intro.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Ethics overlay
Red stops: marketplace how-tos, unauthorized prod access, corp mass-enum, doxxing, prod paste.
RoE branch always green start — `$TI_LAB` on separate labeled branch.
3. Integrity breakpoint
Mark where scope check prevented out-of-RoE collection or prod access.
One paragraph uplift from YOUR `$TI_LAB` path.
4. What you ship: lab path diagram
TI chain with ethics gates + UTC milestones — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Lab path includes marketplace IOC ingest shortcut lane.
Right
Lab path documented for $TI_LAB. Next: Evidence Pack.
Mission: lab path diagram
1) Map nine stations. 2) Add six ethics gates. 3) UTC milestones per station. 4) Link evidence index IDs.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
Knowledge Check
APPLY: Lab path documents:
Multiple choice
Knowledge Check
APPLY: True or False: Marketplace shortcut OK on path.
True or False
Knowledge Check
APPLY: Path ends at:
Multiple choice