Incident › Module 3 › Lesson 3
Runbook Hygiene
Runbook hygiene literacy covers version control, test cadence, owner assignment, and stale-step removal — maintain runbooks on YOUR $IR_LAB tool placeholders.
Visual · t34_runbook_hygiene
Runbook hygiene literacy. $IR_LAB only. Original Cyberlium.
Opening
Stale runbooks kill incidents — literacy teaches hygiene habits so tabletop tool steps stay accurate on lab placeholders you govern.
Runbooks are tool-specific procedure steps — isolate host in EDR, disable account in IdP, block domain on firewall. Hygiene means version numbers, last-tested date, named owner, and removal of deprecated CLI flags. Untested runbooks fail when adrenaline hits. Cyberlium writes runbook hygiene checklist on YOUR $IR_LAB — one fictional EDR isolate step with version and owner fields. Next: Playbooks Lab.
1. Runbook hygiene fields (named)
Version and date: v1.3 tested 2026-01-15. Owner: team or role responsible for updates. Prerequisites: ticket ID, IC approval, evidence snapshot. Steps: numbered actions on YOUR org assets. Rollback: how to undo if containment causes outage.
On $IR_LAB, write runbook row — tool placeholder, version, owner, last-tested date for fictional isolate step.
Command guide
Try these commands — Runbook hygiene fields (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); ISO/IEC 27035 (https://www.iso.org/standard/78973.html); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why hygiene prevents incident-time surprises
Deprecated API steps waste minutes during P1. Missing rollback causes self-inflicted outages. Quarterly tabletop tests expose stale runbooks before production need.
Students document lab runbook metadata on notes — production runbooks follow ITSM and change windows.
3. Lab boundary
Forbidden: runbook steps targeting stranger SaaS tenants or deploying destructive payloads. Allowed: runbook hygiene card — metadata fields with $IR_LAB fictional tool placeholders.
Ship: runbook hygiene card for YOUR lab tools. Next: Playbooks Lab.
4. What you ship: runbook hygiene card for $IR_LAB
Version, owner, test date, rollback note. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Runbook hygiene card. $IR_LAB named. File t34-m03-l03-runbook-hygiene.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Copy production runbook with real credentials into lab. Skip version and owner fields.
Right
Write runbook hygiene card for YOUR $IR_LAB. Next: Playbooks Lab.
Mission: document runbook hygiene on YOUR lab
1) List five hygiene fields. 2) Write one fictional EDR isolate runbook row. 3) Add rollback sentence. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Last-tested date is a promise — tabletop the runbook or mark it untested.
Knowledge Check
APPLY: Runbook hygiene primarily ensures:
Multiple choice
Knowledge Check
APPLY: True or False: Runbooks should include rollback steps.
True or False
Knowledge Check
APPLY: Runbook hygiene literacy on Cyberlium uses:
Multiple choice