SOC › Module 6 › Lesson 2
Roles in IR
IR roles literacy — IR lead, L2 analyst, L3/forensics, comms, legal, management — on $HUNT_LAB tabletop stubs.
Visual · t30_roles_in_ir
IR roles = named responsibility rows. $HUNT_LAB. Original Cyberlium.
Opening
Incidents need owners — name IR roles on YOUR tabletop stub before anyone confuses hunt analyst with comms lead.
IR roles literacy names: IR lead (coordination, severity calls), L2 hunt/respond analyst (telemetry, containment recommendations on lab notes), L3/forensics (deep dive, evidence handling), comms/PR (stakeholder updates category), legal/compliance (notification category), executive sponsor (resource decisions). Analyst assigns $HUNT_LAB tabletop scenario roles — documents RACI-style rows at literacy level — without impersonating legal, without unauthorized prod executive pages, without solo 'hero' response skipping handoffs. Cyberlium teaches professional role boundaries aligned Module 9 L3 handoff. Refused: unauthorized prod comms, blaming roles in notes, executing forensics on stranger systems. Lab row: six roles with one responsibility and one boundary each.
1. Named IR roles
IR lead, L2 analyst, L3/forensics, comms, legal, exec — six literacy anchors.
Role clarity prevents duplicate work and missed notifications.
Command guide
Try these commands — Named IR roles
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: python3, grep. Reference sites: IR roles (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST CSIRT (https://www.first.org/global-society/teams); SANS (https://www.sans.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. L2 analyst boundary
L2 recommends containment options — executes only within RoE on authorized lab hosts.
Escalate to L3 when forensics scope exceeds lab stub — link Module 9-3.
3. Refused
No unauthorized prod executive or legal comms; no forensics on stranger assets.
Role literacy supports coordination — not authority impersonation.
4. What you ship: IR roles table
Six roles + responsibility + boundary each + NEVER unauthorized prod comms line.
5. What you record before the next lesson
IR roles table path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Send unauthorized 'incident notification' email to employer customers as tabletop practice.
Right
IR roles table from $HUNT_LAB tabletop stub. Next: Evidence Hygiene.
Mission: IR roles table
1) List six IR roles. 2) One responsibility and boundary per role. 3) Assign roles to lab tabletop scenario. 4) Write NEVER unauthorized prod comms line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “L2 vs L3 — when forensics handoff?”
Knowledge Check
APPLY: IR roles literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized prod incident emails are lab.
True or False
Knowledge Check
APPLY: L2 analyst typically:
Multiple choice