Sanitise an incident into something you could publish

applied · 65 min · Objective 4.3

Task

Apply objective 4.3: take one incident's output and produce a shareable bundle, stripping everything that must not leave -- then prove the stripping worked.

Steps

  1. Assemble the raw material in lab/share/raw.json: indicators, the technique, the detection approach, and the internal context around them.
  2. Write lab/share/strip-rules.md listing what must be removed: internal addresses and hostnames, usernames and paths containing names, your own infrastructure, business context, and detection detail you choose not to reveal.
  3. Produce lab/share/sanitised.json structured as objects and relationships -- indicator, malware or tooling, attack pattern, observed data -- with a confidence and a validity period on every indicator.
  4. Write lab/share/verify-strip.sh that greps the sanitised file for your internal ranges, your domain, and a list of your usernames, and exits non-zero if any is present. Run it.
  5. Add a redistribution marking and record who in your organisation has the authority to publish, referencing the RACI from domain 1.

Verify

sh lab/share/verify-strip.sh; echo "strip check exit=$?"
grep -Eoc '"(indicator|attack-pattern|observed-data|relationship)"' lab/share/sanitised.json
grep -Eci 'valid_until|expires|confidence' lab/share/sanitised.json
grep -Eci 'tlp|marking|authority' lab/share/strip-rules.md

The strip check exiting 0, at least three object types present, every indicator carrying confidence and an expiry, and a marking plus a named authority. Then deliberately reinsert an internal hostname and confirm the check goes non-zero -- a strip check you have not seen fail is not a strip check.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.