Incident › Module 5 › Lesson 1
Containment Options
Containment options literacy names network isolation, account disable, host quarantine, and DNS blocks — evaluate options on YOUR $IR_LAB org assets only.
Visual · t34_containment_options
Containment options literacy. $IR_LAB only. Original Cyberlium.
Opening
Containment stops spread — literacy names options so tabletop decisions target YOUR org assets, never stranger networks or destructive payloads.
Containment options include host network isolation via EDR, account disable in IdP, firewall block rules, DNS sinkhole, and temporary VLAN move — all on systems YOUR org owns. Each option trades spread prevention against business disruption. IC approves containment with scribe logging decision rationale. Cyberlium lists containment options on YOUR $IR_LAB — match three options to fictional tabletop scenario with pros and cons. Next: Short vs Long.
1. Containment options (named)
Host isolation: EDR network containment on enrolled endpoint — YOUR org asset. Account disable: IdP lock for compromised credential. Network block: firewall deny for C2 IP on YOUR perimeter. Service stop: pause affected app tier with change approval.
On $IR_LAB, write options table — option, asset scope, disruption note, IC approval flag for fictional inject.
Command guide
Try these commands — Containment options (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA Stop Ransomware (https://www.cisa.gov/stopransomware); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why options literacy prevents wrong-tool containment
DNS block misses IP-direct C2. Account disable without session revoke leaves active tokens. Tabletops compare options before production adrenaline.
Students evaluate lab options on notes — production containment follows change control and asset inventory.
3. Lab boundary
Forbidden: containment steps on stranger ISP, cloud tenants, or ransomware deployment. Allowed: containment options card — three options on $IR_LAB YOUR org assets only.
Ship: containment options card for YOUR lab scenario. Next: Short vs Long.
4. What you ship: containment options card for $IR_LAB
Three options with scope and disruption notes. $IR_LAB named. YOUR org only. chmod 600.
5. What you record before the next lesson
Date. Containment options card. $IR_LAB named. File t34-m05-l01-containment-options.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Isolate stranger cloud tenant for practice. Deploy ransomware to 'test containment.'
Right
Write containment options card for YOUR $IR_LAB org assets. Next: Short vs Long.
Mission: list containment options on YOUR lab
1) Name four containment options. 2) Match three to fictional scenario with pros/cons. 3) Confirm YOUR org asset scope only. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Every containment option needs asset scope — if you do not own it, you do not isolate it.
Knowledge Check
APPLY: Host network isolation via EDR applies to:
Multiple choice
Knowledge Check
APPLY: True or False: Containment decisions should be IC-approved and scribe-logged.
True or False
Knowledge Check
APPLY: Containment options literacy on Cyberlium avoids:
Multiple choice