Threat › Module 2 › Lesson 4
Lab — Fundamentals
Pack TI types, intel lifecycle, and consumers cards — fundamentals file from $TI_LAB only.
Visual · t33_fundamentals_lab
Lab: TI fundamentals pack. $TI_LAB only. Original Cyberlium.
Opening
Fundamentals pack merges types to lifecycle to consumers — paperwork before IOC module.
Lessons 2-1–2-3 named TI types, intel lifecycle, and intel consumers. This lab merges three cards into one $TI_LAB fundamentals artifact with M1 ethics cross-reference. No criminal marketplace collection — TI fundamentals paperwork only. Next: Quiz — TI Fundamentals.
1. Lab contract: TI fundamentals pack
Create $HOME/cyberlium-lab/t33-m02-l04-fundamentals-lab.txt merging TI types, lifecycle, and consumers sections with $TI_LAB fictional IOC example and M1 ethics cross-reference.
Optional: one-line note which fictional actor name you used — lab labels only.
Command guide
Try these commands — Lab contract: TI fundamentals pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ FIRST — https://www.first.org/ CISA — https://www.cisa.gov/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
python3 - <<'PY'
import os
lab = os.environ.get('TI_LAB', os.path.expanduser('~/cyberlium-lab/t33-ti'))
path = os.path.join(lab, 'notes', 'fundamentals-lab-summary.md')
open(path, 'w').write('
'.join([
'# TI Fundamentals Lab Summary',
'## Completed (YOUR lab)',
' - intel-lifecycle.md reviewed',
' - intel-consumers-named.txt drafted',
'## Key takeaways',
' - Strategic/operational/tactical layers serve different audiences',
' - Intel cycle ends with feedback — stale IOCs must retire',
'## Refusals',
' - No criminal markets; no doxxing; fake IOCs only',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'Refusals|intel-lifecycle' "$TI_LAB/notes/fundamentals-lab-summary.md"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t33-ti/notes/intel-lifecycle.md | Select-String Collection
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); FIRST (https://www.first.org/); CISA (https://www.cisa.gov/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check refusal boundaries
Grep pack for criminal marketplace refs, live victim IOC dumps, stolen credential links — redact or delete. Pack stays documentary literacy.
Update pack if you rename lab actor — note new fictional label.
3. Lock the proof
chmod 600 on the pack. Quiz next — then IOC Named.
TI fundamentals literacy feeds IOC and TTP lessons in M3.
4. What you ship: TI fundamentals pack for $TI_LAB
Merged types, lifecycle, consumers sections. $TI_LAB named. NO criminal collection. chmod 600.
5. What you record before the next lesson
Date. Fundamentals pack path. $TI_LAB named. File t33-m02-l04-fundamentals-lab.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include live breach IOC dump in pack. Skip consumers section.
Right
Write YOUR TI fundamentals pack for $TI_LAB. chmod 600. Next: Quiz — TI Fundamentals.
Mission: freeze YOUR TI fundamentals pack
1) Merge M2 literacy sections. 2) Confirm zero criminal marketplace refs. 3) Link M1 ethics cross-ref. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed fundamentals pack beats ten unauthorized feed screenshots.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Fundamentals pack should reference $TI_LAB fictional IOCs.
True or False
Knowledge Check
APPLY: Fundamentals pack should include:
Multiple choice