T-IK-half-B — Insights + Kartis, ½ day: SOC focus

Lab guide · Isla Mercantile Group · 195m net (09:00–12:30)

Schedule

Time	Block	Minutes
09:00	I-M0 — Welcome & client brief	15
09:15	I-M2 — How Insights sees (live)	45
10:00	I-M3 — Dashboard tour	40
10:40	Break	15
10:55	I-M7 — Threat on the wire	35
11:30	K-2 — Is the C2 ours?	35
12:05	Quiz	20
12:25	Wrap-up	5

Before you start

Log in

Your slip has your own credentials. Nobody shares a login; working in pairs on one login (one drives, one checks) is fine.

System	Address	Login	Used in
Eon Insights	`https://insights.edu.eoncore.net`	`traineeNN`	I-blocks, I-TAG, X1
Eon Center	`https://center.edu.eoncore.net`	`traineeNN` (`org_admin` of `team-NN`)	C-blocks, K-blocks, X1
Center, Kartis pages only	`https://center.edu.eoncore.net`	`kNN` (`kartis_only`)	K-blocks in the Insights + Kartis tracks
Isla public sites	`https://<vhost>.isla.edu.eoncore.net`	none	I-M2, K-1, C6, I-M11

In Center, switch the UI to EN on first login. Your Center organisation team-NN has one customer: Isla Mercantile Group (team-NN). traineeNN and kNN are both members of team-NN and work on that same customer.

Shared environment

One Insights for the whole group. Tags are shared: every team sees the others' tags appear.
Custom views are shared: every view you save is in everyone's list. Prefix the name with your team or login (webshop — chain); do not change or delete a view you did not create.
There is no personal reset. Do not delete data, uploads or tags you did not create.
Tag rule: tag only hosts of your own app, one person per host, never remove tags you did not set. Full convention: Tag convention.
Center and the Kartis pages keep state per team customer: register upload, posture runs, finding status and labels are shared by traineeNN and kNN of the same team, and invisible to other teams.
Traffic replays (probe chapters) are started by the trainer. You need no shell on the server.
AI: the Insights Chat is available in the Insights blocks. The Kartis pages have no AI.

Isla at a glance

Client: Isla Mercantile Group, retail and payments, Curaçao. Internal names <host>.<app>.isla.test in 10.20.0.0/16; public names <vhost>.isla.edu.eoncore.net.

App (team)	Internal hosts	Subnet	Public vhosts
webshop	`shop`, `api`, `db`, `pay` `.webshop.isla.test`	10.20.1.0/24	`www`, `shop`, `api`, `pay`
intranet	`sso`, `portal`, `cache` `.intranet.isla.test`	10.20.2.0/24	`intranet`
payments	`gw`, `vpn`, `hsm` `.payments.isla.test`	10.20.3.0/24	none
loyalty	`app`, `api`, `old` `.loyalty.isla.test`	10.20.4.0/24	`loyalty`, `loyalty-old`

Hosts outside isla.test and isla.edu.eoncore.net are background noise. Search isla.test to hide them.

Client documents (handed out per block): client brief, ckm-intake.xlsx, register.xlsx, register-flawed.xlsx.

Exercises

I-M0 — Welcome & client brief

09:00 · 15 min

Exercise	Task	Finding
I-M0.1	Log in to Insights; note the number of unique hosts on Home. Ask the Chat which hosts under `isla.test` have the lowest level. Center tracks: also log in to Center	—

I-M2 — How Insights sees (live)

09:15 · 45 min

Exercise	Task	Finding
I-M2.1	Note your source IP and the time. Browse to `https://www.isla.edu.eoncore.net` and `https://pay.isla.edu.eoncore.net`. Find your own handshakes in Handshakes (last 15 min, filter SNI); note TLS version, cipher, JA3	F02
I-M2.2	Compare your JA3 with a neighbour on the same browser and one on another browser	—
I-M2.3 (full)	Force a 3DES handshake with `openssl` (appendix B.1) and find it in Insights	F02

I-M3 — Dashboard tour

10:00 · 40 min

Exercise	Task	Finding
I-M3.1	Hosts: filter insecure + weak, search `isla.test`, last 7 days. List host and level	F01, F02, F05, F07, F08, F13
I-M3.2	HostDetails `db.webshop.isla.test`: worst TLS version, insecure suite, cert key. Why insecure, not weak?	F01
I-M3.3	Certificates, sort Valid until ascending: first Isla certificate, days left, host	F03

I-M7 — Threat on the wire

10:55 · 35 min

The trainer plays the beacon chapter at the start of the block.

Exercise	Task	Finding
I-M7.A	Handshakes: find recent handshakes to an unknown external SNI. Note source, destination, SNI, JA3, fingerprint verdict. Measure the interval (appendix A.3). Standard/full: check the client for other traffic; write two or three sentences for a colleague	F10
I-M7.B (standard, full)	Ask the Chat what the beacon means and what the SOC does now, with your own values; note the two most useful recommendations	F10

K-2 — Is the C2 ours?

11:30 · 35 min

Exercise	Task	Finding
K-2.1	Look up the C2 domain and IP from I-M7 in Hosts, Domains, Certificates, DNS / Email and the Scorecard apex list. Part of Isla's perimeter? What do you ask the client?	F10
K-2.2	Central register → Generate draft, run Crypto posture, Findings with verdict `rogue`: name, issuer, since when, action, owner	F09
K-2.3	In pairs, one line each for F10 and F09: whose asset, response owner, first three actions, message to the CISO	F09, F10

Queries, live checks and templates

Queries

Run these through the Insights Chat. The Chat only accepts SELECT/WITH and rejects any query containing words such as INSERT, UPDATE, DELETE, ALTER, CREATE, REPLACE, SET anywhere in the text.

A.3 Beacon interval (I-M7.A)

SELECT src_ip, dst_ip, sni, ja3, count() AS beacons,
       arrayDifference(arraySort(groupArray(toUnixTimestamp(timestamp)))) AS intervals_s
FROM tls_hellos
WHERE sni = 'cdn-update-check.net'
GROUP BY src_ip, dst_ip, sni, ja3

Live checks

Against the Isla public sites. Always pass -servername: web-b routes by SNI, and a client without SNI lands on pay. OpenSSL 3 needs @SECLEVEL=0 in the cipher string for 3DES and TLS 1.0; drop :@SECLEVEL=0 on LibreSSL (openssl version tells you which one you have). Some Linux distributions block TLS 1.0 in the system crypto policy even with @SECLEVEL=0; B.1b shows whether yours does. If it does, use testssl.sh or pair with someone whose client can.

B.1 3DES on `pay` (I-M2.3, K-1.6, C6.1)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1_2 -cipher 'DES-CBC3-SHA:@SECLEVEL=0' </dev/null