SOC › Module 10 › Lesson 1
Checklist
Topic 30 capstone checklist — hunt mindset, ATT&CK hunting, advanced SIEM, correlation, IR lifecycle, containment, eradication, PIR on $HUNT_LAB.
Visual · t30_capstone_checklist
Checklist consolidates SOC L2/L3 literacy pillars. $HUNT_LAB only. Original Cyberlium.
Opening
Capstone proves SOC L2/L3 literacy on YOUR authorized hunt-lab work — not unauthorized prod IR or offensive playbooks.
Assemble checklist covering Modules 1–9: L2 mindset and lab telemetry, threat hunting methodology, ATT&CK mapping, advanced SIEM literacy, correlation and dashboards, PICERL and IR roles, containment decision literacy, eradication and recovery, PIR and L3 handoff. Use on capstone walk of YOUR $HUNT_LAB — never unauthorized prod hunt or IR, never lateral movement or malware cookbooks, never prod containment without RoE, never validation fraud. Each row links artifact or honest N/A. Notes chmod 600 under $HOME/cyberlium-lab. Integrity rows: $HUNT_LAB only, RoE stated, containment/eradication as defender decision literacy on lab host notes, limitations documented.
1. Scope and ethics
$HUNT_LAB named with RoE reference. NEVER unauthorized prod IR, NEVER offensive playbooks, NEVER prod containment without ticket, NEVER malware authoring.
Containment and eradication = isolate YOUR lab host in notes — defender vocabulary only.
Command guide
Try these commands — Scope and ethics
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: SOC L2/L3 capstone (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Elastic (https://www.elastic.co/guide/en/security/current/index.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy pillars
Hunt, ATT&CK, SIEM, correlation, PICERL, containment, eradication, PIR — linked rows.
Cross-link Topic 29 SOC L1 as prerequisite track — separate unauthorized paths refused.
3. Teardown
Notes secured chmod 600, report pack ready, lab telemetry exports archived optional per brief.
Archive retention note for mentor handoff.
4. What you ship: Topic 30 capstone checklist
One-page SOC Level 2 & 3 literacy capstone checklist for $HUNT_LAB.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Checklist includes row 'lateral movement playbook for capstone bonus.'
Right
Checklist written. Next: Lab Path.
Mission: write capstone checklist
1) Ethics/scope section. 2) Modules 1–9 pillar rows. 3) Teardown and handoff section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Offensive playbooks required for capstone.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice