Incident › Module 10 › Lesson 1
Checklist
Topic 34 capstone checklist — IR mindset, planning, playbooks, detection, containment, eradication, ransomware tabletop, comms, PIR on `$IR_LAB`.
Visual · t34_capstone_checklist
Checklist consolidates Incident Response literacy pillars. $IR_LAB only. Original Cyberlium.
Opening
Capstone proves Incident Response literacy on YOUR authorized `$IR_LAB` work — not payload creation or unauthorized prod IR.
Assemble checklist covering Modules 1–9: IR mindset and lab scope, planning and severity, team and playbooks, detection and analysis, containment literacy, eradication and recovery, ransomware tabletop and payment ethics, comms and legal, post-incident PIR. Use on capstone walk of YOUR `$IR_LAB` — never ransomware payloads, never payment negotiation crime how-tos, never unauthorized prod IR or notifications, never stranger network containment. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab/t34-ir/. Integrity rows: `$IR_LAB` only, tabletop scenarios fictional, no payload how-tos, limitations documented.
1. Scope and ethics
$IR_LAB named with RoE reference. NEVER payload creation, NEVER payment crime how-tos, NEVER unauthorized prod IR, NEVER stranger network ops.
Ransomware module = tabletop defender literacy — not encryptor authoring.
Command guide
Try these commands — Scope and ethics
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA Stop Ransomware (https://www.cisa.gov/stopransomware); FIRST (https://www.first.org/); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
PICERL, playbooks, detection, containment, eradication, tabletop, comms, PIR — linked rows.
Cross-link Topic 33 Threat Intelligence as upstream context — separate authorized track.
3. Teardown
Notes secured chmod 600, evidence pack ready, lab stubs archived per brief.
Retention note for mentor handoff.
4. What you ship: Topic 34 capstone checklist
One-page Incident Response literacy capstone checklist for $IR_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'ransomware payload build for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Ransomware payload build required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice