Cheat notes · Module 03 · When it happens
Incident response
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Preserve evidence and contain a compromised dependency, workflow or image. Three incident records name the surface, timeline, containment and follow-up control.
Remember
- Surface: The lab incident is a controlled simulation with no exfiltration or real credential.
- Trust: A failed admission can be evidence that a boundary is working.
- Evidence: Rotate credentials after preserving the minimum useful run metadata.
- Owner: assign the control and retest to a named team.
Pitfalls
- A single control can be lifted or misconfigured; test independent layers.
- Preserve useful run evidence before disabling the path or rotating credentials.
Commands
./scripts/validate.sh | Check evidence files without executing learner code. |
git log --oneline -3 | Find the recent commits that changed the surface. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
The lab incident is a controlled simulation with no exfiltration or real credential.
What do you test?
Work three seeded incident cases: moved action reference, unknown workflow and denied image. Disable the affected path, rotate the fake credential, capture evidence and update the register.
What evidence proves the fix?
Three incident records name the surface, timeline, containment and follow-up control.
Where module 03 leaves you: Three incident records name the surface, timeline, containment and follow-up control.