SOC › Module 7 › Lesson 1
Containment Options
Containment options literacy — network isolation, account disable, host quarantine categories — defender decision vocabulary on YOUR $HUNT_LAB host notes.
Visual · t30_containment_options
Containment options = named defender decisions. $HUNT_LAB host notes. Original Cyberlium.
Opening
Containment limits damage — learn named options and tradeoffs on YOUR lab host notes, never attacker lateral-movement how-tos.
Containment options literacy names defender choices: network isolation (segment lab host — Module 7-2), account disable/reset (Module 7-3), host quarantine via EDR category, temporary firewall deny rule category, and watch-only when scope uncertain. Analyst documents containment decision matrix on $HUNT_LAB synthetic compromised-host stub — cites hunt findings, lists pros/cons, selects recommended option for lab scenario — without isolating prod systems without RoE, without writing lateral movement scripts, without malware deployment to 'prove' containment need. Cyberlium teaches decision literacy: isolate YOUR lab host in notes — NOT how to spread or persist on stranger networks. Refused: prod containment without ticket, attack repro, disabling security controls on employer assets. Lab row: four containment options with decision criteria each.
1. Named containment options
Network isolate, account action, host quarantine, firewall deny, watch-only — five literacy anchors.
Decision matrix weighs blast radius vs business impact — even on lab stubs.
Command guide
Try these commands — Named containment options
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: Containment options (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); NIST containment (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS IR (https://www.sans.org/white-papers/incident-handlers-handbook/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Decision literacy
Containment follows confirmed scope from PICERL Identification — not panic.
Document chosen option and rejected alternatives with UTC.
3. $HUNT_LAB boundary
Containment notes reference YOUR lab host stub — not unauthorized prod isolation.
Refused: lateral movement, malware deploy, prod EDR disable.
4. What you ship: containment options matrix
Four options + decision criteria + lab host recommendation + NEVER attack repro line.
5. What you record before the next lesson
Containment options matrix path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deploy malware on lab network then 'contain' by attacking other hosts.
Right
Containment options matrix from $HUNT_LAB host stub. Next: Network Isolation Named.
Mission: containment options matrix
1) Name four containment options. 2) Decision criteria per option. 3) Recommend one for lab host stub. 4) Write NEVER attack repro line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Watch-only — when scope uncertain?”
Knowledge Check
APPLY: Containment literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Malware deployment to practice containment is lab.
True or False
Knowledge Check
APPLY: Containment decision should:
Multiple choice