Incident › Module 5 › Lesson 3
Decision Trees
Decision trees literacy maps if-then containment branches — author decision tree on YOUR $IR_LAB scenarios with IC escalation nodes.
Visual · t34_decision_trees
Decision tree literacy. $IR_LAB only. Original Cyberlium.
Opening
Branches beat guesswork — literacy teaches containment decision trees so tabletop paths stay consistent when signals change.
Containment decision trees start with confirmed indicators — e.g., 'lateral movement observed?' If yes, escalate to IC and isolate segment on YOUR org network. If no, continue monitoring with enhanced logging. Branches include rollback nodes — if isolate causes clinical system outage, IC chooses alternate path. Cyberlium draws decision tree on YOUR $IR_LAB — three nodes with yes/no branches for fictional phishing inject. Next: Containment Lab.
1. Decision tree nodes (named)
Root question: observable condition from analysis — credential use from unusual geo. Branch actions: monitor, contain host, disable account, escalate IC. Terminal nodes: scribe logs decision, ticket updated, comms hook if P1. Rollback diamond: business impact exceeds threshold — IC selects alternate.
On $IR_LAB, sketch tree — root question, two branches, one IC escalation node for fictional scenario.
Command guide
Try these commands — Decision tree nodes (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why trees reduce inconsistent containment
Ad-hoc decisions vary by analyst shift. Trees encode policy into repeatable branches tested in tabletops. Update tree when post-incident review finds gap.
Students draw lab trees on notes — production trees align with playbooks and legal guidance.
3. Lab boundary
Forbidden: tree branches that isolate stranger networks or deploy payloads. Allowed: decision tree card — three nodes on $IR_LAB YOUR org scenario.
Ship: decision tree card for YOUR lab scenario. Next: Containment Lab.
4. What you ship: decision tree card for $IR_LAB
Root, branches, IC node, rollback note. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Decision tree card. $IR_LAB named. File t34-m05-l03-decision-trees.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draw tree with no IC escalation path. Add stranger-network isolate branch.
Right
Write decision tree card for YOUR $IR_LAB. Next: Containment Lab.
Mission: draw containment tree on YOUR lab
1) Write root question from fictional analysis. 2) Add yes/no branches with actions. 3) Mark IC escalation and rollback node. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Every tree needs an IC node — containment without command is chaos.
Knowledge Check
APPLY: Containment decision trees primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Rollback nodes address business impact from containment actions.
True or False
Knowledge Check
APPLY: Decision tree literacy on Cyberlium uses:
Multiple choice