Threat › Module 7 › Lesson 4
Lab — Platforms
TI platforms lab on `$TI_LAB` — MISP map, OpenCTI sketch, platform ops checklist bundled.
Visual · t33_platforms_lab
Lab: platforms pack on YOUR $TI_LAB yaml stubs. Original Cyberlium.
Opening
Ship platform literacy artifacts from YOUR stubs — MISP, OpenCTI, ops — zero unauthorized prod tenant access or marketplace pipelines.
On YOUR `$TI_LAB` per brief: (1) scope proof — yaml/notes labeled YOUR account; (2) MISP concept map Module 7-1; (3) OpenCTI concept sketch Module 7-2; (4) platform ops checklist Module 7-3; (5) cross-link diagram stub (MISP event → OpenCTI entity literacy); (6) integrity — `$TI_LAB` only, concept stubs not prod admin, no victim PII, no marketplace import; (7) chmod 600 pack. Cross-link Module 6 feeds — connector rows reference STIX/TAXII literacy only.
1. Lab deliverables
MISP + OpenCTI + ops — single platform thread cross-indexed.
Cross-link diagram shows stub data flow — not live connector poll.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MISP — https://www.misp-project.org/ OpenCTI — https://github.com/OpenCTI-Platform/opencti MITRE ATT&CK — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export TI_LAB=${TI_LAB:-$HOME/cyberlium-lab/t33-ti}
cat > "$TI_LAB/platforms/platforms-lab-index.md" <<'EOF'
# TI Platforms Lab Index — YOUR notes
- misp-named.txt: events, attributes, sharing concepts
- opencti-named.txt: knowledge graph, STIX import
- platform-ops-checklist.md: RBAC, retention, audit
- Cross-ref: iocs/iocs.json → STIX stub in stix/fake-indicator-stub.json
## Integrity
- Concept literacy only — YOUR fake data, authorized platforms
EOFCommand — copy this
grep -E 'Integrity|fake data|misp-named' "$TI_LAB/platforms/platforms-lab-index.md"
ls "$TI_LAB/platforms/"
python3 -c "print('Platforms lab: MISP + OpenCTI concepts mapped to YOUR fake IOCs')"═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t33-ti/platforms/misp-named.txt | Select-String NEVER
Primary tools to practice this lesson: grep, python3. Reference sites: MISP (https://www.misp-project.org/); OpenCTI (https://github.com/OpenCTI-Platform/opencti); MITRE ATT&CK (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
All entities fictional — labeled sample from Module 3 IOC stubs.
Zero prod tenant URLs or marketplace references in any file.
3. Teardown
Secure yaml chmod 600; no stubs pushed public with accidental keys.
Archive optional per brief.
4. What you ship: platforms lab pack
MISP + OpenCTI + ops + cross-link + integrity — chmod 600.
5. What you record before the next lesson
Platforms lab pack path.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Platforms lab includes live prod MISP admin session export as deliverable.
Right
Platforms lab pack on `$TI_LAB` stubs. Next: quiz.
Mission: platforms lab
1) Scope and stub proof. 2) MISP map and OpenCTI sketch. 3) Platform ops checklist. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Cross-link diagram — minimum nodes?”
Knowledge Check
APPLY: Platforms lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Victim PII in platform lab yaml is OK.
True or False
Knowledge Check
APPLY: Platforms pack includes:
Multiple choice