Lion Cipher Lab
Classify a breach with VERIS and turn one incident into countable data
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A free-text incident writeup reads fine to a human and is useless to a computer: you cannot count it, compare it, or trend it. The moment a board asks "are we getting phished more this year, and how do we stack up against everyone else?" you need incidents as structured DATA, not prose. VERIS is the open framework the Verizon DBIR is built on, and it is how you turn "someone got phished and we lost customer records" into a row you can tally against thousands of others. Learn to code one incident by hand and the whole idea of a metrics program stops being abstract.
What you'll learn
- Coding an incident in the VERIS schema
- The 4 A's (Actor, Action, Asset, Attribute)
- Using controlled vocabularies / enumerations
- JSON Schema validation in Python
- Aggregating incidents into metrics
Steps in this lab
- Why free text can't be counted — and what the 4 A's fix
- Set up: get the schema and enumerations (offline, free)
- The scenario — one breach, in plain words
- Code the 4 A's into a VERIS object — explaining each branch
- Validate it — and watch a bad value get caught
- The payoff: structure lets you COUNT
- The honest experiment: two analysts, the same incident
- What VERIS is NOT — and when to reach for it