Capstone -- be the SOC for a week of your own lab

capstone · 180 min · Objective 1.6

Task

Run your lab as a monitored environment for a week, then answer the questions a security operations function exists to answer. Unguided: no step-by-step, and the deliverable is a set of defensible statements rather than a set of commands run.

Steps

  1. Spend the first session getting collection healthy and writing the capability statement. Everything else depends on it.
  2. During the week, run ordinary activity daily so your logs contain a real baseline rather than only the interesting events.
  3. Stage the incident mid-week. Seal your notes.
  4. Hunt at least three times, on different hypotheses, before you investigate.
  5. Investigate the incident cold, then open your notes and score yourself.
  6. Write the coverage report last, using the week's evidence rather than your impressions.

Verify

find /var/log/collected -type f | wc -l
find /var/log/collected -type f -mmin -60 | wc -l
for f in /var/log/collected/*; do printf "%s %s\n" "$(head -1 "$f" | cut -c1-6)" "$f"; done | sort | head -3
grep -c . /tmp/detections.tsv
awk -F'\t' '$3=="never"' /tmp/detections.tsv | wc -l

The first two must be equal: every source still reporting at the end of the week. The third shows the oldest record per source, which is the retention your capability statement claims. The last two are the detection inventory and the count of rules that have never been proven to fire -- and that second number is the single most honest figure in the whole capstone.

Notes

The capstone is passed on the quality of the refusals as much as the findings. An analyst who reports "the beacon ran from the 4th; I cannot establish what it sent, because the traffic was encrypted and I have no endpoint telemetry from that host" has done the job. One who reports "no data was exfiltrated" has not, and the second is easier to write.

Keep all five artefacts. Domain 2 starts by scanning this same estate, and the Domain 3 capstone responds to an incident in it.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.