Incident › Module 8 › Lesson 4
Lab — Comms
Comms and legal lab on `$IR_LAB` — comms plan, legal checkpoints, external notify matrix bundled.
Visual · t34_comms_lab
Lab: comms/legal pack on YOUR $IR_LAB tabletop. Original Cyberlium.
Opening
Ship comms and legal artifacts from YOUR tabletop — templates, legal gates, notify matrix — zero unauthorized live notifications.
On YOUR `$IR_LAB` per brief: (1) scope proof — ransomware tabletop scenario from Module 7 labeled; (2) comms plan stub Module 8-1; (3) legal checkpoint list Module 8-2; (4) external notify matrix Module 8-3; (5) cross-link approval flow diagram stub (comms → legal → external); (6) integrity — `$IR_LAB` only, no unauthorized prod notifications, no live victim PII, no legal impersonation; (7) chmod 600 pack. Cross-link Module 7 tabletop decisions — comms reflects defender policy path only.
1. Lab deliverables
Comms + legal + external notify cross-indexed — single approval flow thread.
Templates reference facts-known vs under-investigation discipline.
Command guide
Try these commands — Lab deliverables
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS IR (https://www.sans.org/for-organizations/incident-response/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each external row has approval owner stub — not analyst solo send.
Zero unauthorized notification notes or live contact details in pack.
3. Teardown
Secure notes chmod 600; templates remain lab-only until org authorization.
Archive stub optional per brief.
4. What you ship: comms lab pack
Comms plan + legal checkpoints + notify matrix + approval flow + integrity — chmod 600.
5. What you record before the next lesson
Comms lab pack path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Comms lab includes sent unauthorized customer emails as proof of completion.
Right
Comms lab pack on `$IR_LAB` tabletop. Next: quiz.
Mission: comms lab
1) Scope and tabletop link proof. 2) Comms plan and legal checkpoints. 3) External notify matrix. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Approval flow diagram — minimum nodes?”
Knowledge Check
APPLY: Comms lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Live regulatory filing is comms lab deliverable.
True or False
Knowledge Check
APPLY: Comms lab pack should:
Multiple choice