OpenCyber Academy
Technical · Chapter 12 · English
Course code: OCA-064Chapter 12: OCA-064-C012

Chapter 12 — Contained laboratory I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 12 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Lab rules"]
  N2["Lab — enrich and route"]
  N3["12.2 Reading the result"]
  N4["12.3 Why route by asset"]
  N5["12.4 Unknown assets"]
  N6["12.5 Lab report"]
  N7["12.6 Improvement ideas"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Lab rules"]
  N2["Lab — enrich and route"]
  N3["12.2 Reading the result"]
  N4["12.3 Why route by asset"]
  N5["12.4 Unknown assets"]
  N6["12.5 Lab report"]
  N7["12.6 Improvement ideas"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]

[Learning outcomes]
    |
    v
[12.1 Lab rules]
    |
    v
[Lab — enrich and route]
    |
    v
[12.2 Reading the result]
    |
    v
[12.3 Why route by asset]
    |
    v
[12.4 Unknown assets]
    |
    v
[12.5 Lab report]
    |
    v
[12.6 Improvement ideas]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) enrich indicator matches with asset ownership; (2) route each match to the right team; (3) handle matches on unknown assets; (4) write a lab report.

12.1 Lab rules

The lab runs offline in the course virtual machine on synthetic data, using only the standard library. No real college logs.

Running offline means the lab cannot contact any real host, even by mistake, and synthetic data means no college or student information is involved. The standard-library rule keeps the scripts readable and avoids installing unknown packages on the course virtual machine. The same rules apply to Contained laboratory II, later in the course. Lab files and outputs stay inside the course virtual machine throughout.

Lab — enrich and route

"""Lab (ch 12): join matched indicators with asset owners and choose a route (synthetic)."""
owners = {"ws-lib-03": ("Library", "staff"), "srv-lms-01": ("Learning platform", "server"), "ws-fin-11": ("Finance", "staff")}
hits = [("ws-fin-11", "invoice-portal.example", "T1566"), ("srv-lms-01", "198.51.100.77", "T1071"),
        ("ws-lab-99", "update-svc.example", "T1071")]
for host, ioc, tech in hits:
    if host not in owners:
        print(host, ioc, tech, "-> UNKNOWN ASSET: ask network team"); continue
    dept, kind = owners[host]
    route = "incident response (server)" if kind == "server" else "service desk + " + dept
    print(host, ioc, tech, "->", route)

Run with python3 lab_enrich.py. Verified output:

ws-fin-11 invoice-portal.example T1566 -> service desk + Finance
srv-lms-01 198.51.100.77 T1071 -> incident response (server)
ws-lab-99 update-svc.example T1071 -> UNKNOWN ASSET: ask network team

12.2 Reading the result

ws-fin-11 matched invoice-portal.example (Phishing, T1566); it is a Finance staff machine, so the route is service desk plus the Finance department. srv-lms-01, the learning-platform server, matched an address associated with Application Layer Protocol (T1071) command traffic; servers go to incident response. ws-lab-99 is not in the owner list — the script asks the network team rather than guessing.

The script decides only the route; it does not decide whether a match is serious. That judgment stays with the receiving team, who know their systems. Printing the host, indicator and technique beside each route lets Tomás check every line before acting on it.

12.3 Why route by asset

A staff machine contacting a phishing domain may need a password reset and a conversation; a server talking to a command address may be compromised and needs incident response immediately.

The difference lies in what each machine does and who relies on it. A Finance staff machine affects one user, and the service desk can reset passwords and speak to them. The learning-platform server serves 6,000 users, so a possible compromise there needs incident response without delay. Routing by asset type therefore sends each match to the team best placed to act quickly.

12.4 Unknown assets

Unknown hosts are common: new machines, lab equipment, devices named differently. Each is a gap in the inventory to close.

In the lab, ws-lab-99 is such a gap, and guessing an owner could send a match to the wrong team. Asking the network team identifies the device and adds it to the owner list for next time. Tomás counts unknown hosts in each lab run, so the size of the inventory gap is visible. Each unknown host is also logged as a ticket for the network team, with the lab's synthetic name and match.

12.5 Lab report

Aim, method, results with exact outputs, interpretation, problems and one improvement.

Exact outputs matter because a reviewer compares them with a rerun of the same script. Interpretation explains why each route is right, such as servers going to incident response. Problems and an improvement show that the student tested the script's limits, not just ran it once and copied the output. The lab report is about one page long for each pair. Tomás's report included the unknown-asset count and the Finance server rule his pair added. Tutors mark it against these six headings, so a missing heading costs marks even when the script itself works.

12.6 Improvement ideas

Add last-seen times; add severity by technique; read the owner list from a file maintained by the network team.

Last-seen times help the receiving team judge whether the match is current or historic. Severity by technique could put T1071 command traffic ahead of a single phishing visit. Reading owners from the network team's file would keep the list current without editing the script, which removes one cause of stale routing. Each idea is tested on the lab data before it is written up as an improvement. Reading owners from a file also means a missing owner can be fixed by editing data, without changing and retesting the code. Students record which idea they tried and what changed in the output.

12.7 Pair work

One student runs, the other checks outputs against expectations, then swap.

The partner compares each printed route with what they expect from the owner list before the pair agrees on the result. Swapping roles means both students practise running the script and checking its output. The pair notes any disagreement in their lab report, together with how they resolved it. Tomás's pair found the missing Finance server rule during this checking step, before submitting. Pairs are assigned by the tutor, so students work with someone new in each lab. The check is done line by line against the owner list, not by glancing at the output. Each student signs the report's check record before it is submitted.

12.8 Safety

No real hostnames or addresses in submitted reports; use the lab's synthetic values.

Lab reports leave the virtual machine and may be read by other students or tutors. Using only the synthetic hostnames and RFC 5737 addresses means nothing about college systems is exposed. The partner check includes a scan of the report for any value that does not come from the lab data. The same rule applies to screenshots and pasted output in the report. Reports that fail the scan are rejected, corrected and resubmitted before marking.

Extending the lab

Students may extend the script to read matches from a CSV file and write routes to another file. Any extension must keep the unknown-asset rule.

Worked example

Tomás's pair notices the server route ignores Finance's own server. They add a rule: servers owned by Finance also notify the Finance manager, and record the change in their report's improvements section.

Synthetic case. The lab data is invented teaching material.

Errors and limits

Owner lists go stale; enrichment is only as good as the list.

Exercises

Synthesis

Enrich matches with ownership, route by asset type, treat unknown hosts as inventory gaps and report carefully.

Continue studying — chapter 12 of 18

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →

Worked answers

EX045. ws-fin-11 → service desk plus Finance; srv-lms-01 → incident response (server); ws-lab-99 → unknown asset, ask the network team.

EX046. A server contacting a command address may be compromised and affects many users, so it needs immediate incident handling.

EX047. A gap in the asset inventory; the network team identifies the device and it is added to the owner list.

EX048. Real names would expose college systems outside the lab; coursework uses only synthetic values.