HackBlue

Start

How to write a finding

A lab is finished when someone else can read your note and know what failed, who could act on it, and what you would change. The note is not a retelling of every click.

What the reader needs

The reader was not in the room. They need three sentences. What failed, in the words of the evidence. Who can reach the thing that failed, which may be a mailbox, a host, or a role, not a feeling that “users” are affected. What you would change so the same evidence would look different next time.

Leave out the path you took to notice it, unless that path is the only way to see the evidence. A list of tools is not a finding. A screenshot without the sentence is not a finding either.

A note from the email header lab

This example uses only the payroll message already in the lab. The company is Contoso, the name the exercise uses. Nothing here is a report about a real organization.

Checklist

Before you submit, the note should name all four. If one is missing, the note is not done.

  1. Evidence. The line, header, or packet you are talking about, quoted closely enough that someone can find it.
  2. Time. When the evidence says the event happened, in the zone the log used. A lab with no clock still has an order. Say the order.
  3. Scope. The system the exercise allowed. If the fact sits outside that, the note says so and stops.
  4. The control. The change that would make this evidence come out differently. Not a tool name. The decision.

Where to practice the note

  1. 01All labsThe note is the last step of a lab, after you have read the evidence.
  2. 02Scope deskIf you cannot say the work was in scope, the rest of the note waits.
  3. 03Career pathsAn interview asks for a lab you can describe. This is the shape of that description.
  4. 04Email header labThe filled example below is the payroll message in this lab. Contoso is the lab’s company, not a real one.
  5. 05The case folderKeep the original, a working copy, the hash, and the time. Keep the note beside that folder.
  6. 06The handoffWhat the next person needs: the sentence, the file path, the time, and what you already changed.