Threat › Module 6 › Lesson 4
Lab — Feeds
Feeds lab on `$TI_LAB` — feed inventory, STIX/TAXII concept card, quality scorecard bundled.
Visual · t33_feeds_lab
Lab: feeds pack on YOUR $TI_LAB yaml/notes stubs. Original Cyberlium.
Opening
Ship feed literacy artifacts from YOUR lab stubs — inventory, STIX/TAXII, quality — zero marketplace ingest or unauthorized prod subscriptions.
On YOUR `$TI_LAB` per brief: (1) scope proof — labeled notes/yaml under $HOME/cyberlium-lab/t33-ti/; (2) feed types inventory Module 6-1; (3) STIX/TAXII concept card Module 6-2; (4) feed quality scorecard Module 6-3; (5) feed handling yaml stub (TLP, retention, consumer map); (6) integrity — `$TI_LAB` only, no marketplace leak feeds, no unauthorized prod TAXII/SIEM subscribe, no victim PII in bundles; (7) chmod 600 pack. Cross-link Modules 3–5 IOC and ATT&CK mapping — feeds close coverage gap rows honestly.
1. Lab deliverables
Inventory + STIX/TAXII card + quality scorecard — single feeds thread cross-index.
Handling yaml stub documents TLP and retention literacy rows.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OASIS STIX examples — https://oasis-open.github.io/cti-documentation/stix/examples.html MISP — https://www.misp-project.org/ OpenCTI import — https://docs.opencti.io/latest/usage/import/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install jq
macOS:
Command — copy this
brew install python3 brew install jq
Windows: Download https://python.org/downloads/
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/stix/fake-indicator-stub.json" <<'EOF'
{
"type": "bundle",
"id": "bundle--cyberlium-lab-fake-001",
"objects": [
{
"type": "indicator",
"id": "indicator--cyberlium-lab-fake-domain",
"spec_version": "2.1",
"created": "2026-01-01T00:00:00.000Z",
"modified": "2026-01-01T00:00:00.000Z",
"name": "Lab fake phishing domain",
"pattern": "[domain-name:value = 'phish-lab.example.com']",
"pattern_type": "stix",
"valid_from": "2026-01-01T00:00:00.000Z",
"labels": ["malicious-activity"],
"confidence": 25,
"description": "FAKE lab indicator — example.com only, not real threat data"
}
]
}
EOFCommand — copy this
python3 - <<'PY'
import json, os
lab = os.environ.get('TI_LAB', os.path.expanduser('~/cyberlium-lab/t33-ti'))
p = os.path.join(lab, 'stix', 'fake-indicator-stub.json')
d = json.load(open(p))
ind = [o for o in d['objects'] if o['type']=='indicator'][0]
assert 'example.com' in ind['pattern'], 'lab stub must use example.com'
print(f"STIX stub OK: {ind['name']} confidence={ind['confidence']}")
PYCommand — copy this
command -v jq >/dev/null && jq '.objects[0].pattern' "$TI_LAB/stix/fake-indicator-stub.json" || grep example.com "$TI_LAB/stix/fake-indicator-stub.json"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t33-ti/stix/fake-indicator-stub.json | Select-String example.com
Primary tools to practice this lesson: python3, jq. Reference sites: OASIS STIX examples (https://oasis-open.github.io/cti-documentation/stix/examples.html); MISP (https://www.misp-project.org/); OpenCTI import (https://docs.opencti.io/latest/usage/import/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each row cites lab stub source — not generic TI blog advice.
Zero marketplace references or unauthorized prod subscription notes.
3. Teardown
Secure notes chmod 600; no lab yaml pushed public with accidental keys.
Archive stub optional per brief.
4. What you ship: feeds lab pack
Inventory + STIX/TAXII + quality + handling yaml + integrity — chmod 600.
5. What you record before the next lesson
Feeds lab pack path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Feeds lab includes marketplace IOC ingest script as deliverable.
Right
Feeds lab pack on `$TI_LAB` stubs. Next: quiz.
Mission: feeds lab
1) Scope and stub proof. 2) Inventory and STIX/TAXII card. 3) Quality scorecard three rows. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum handling yaml fields?”
Knowledge Check
APPLY: Feeds lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Marketplace leak feeds belong in feeds lab.
True or False
Knowledge Check
APPLY: Feeds lab pack should:
Multiple choice