🚦 [START HERE] Crew Checklists
| CREWAID VERSION | VERSION_PLACEHOLDER |
|---|---|
| MIP BUILD DATE | MIP_BUILD_PLACEHOLDER |
Checklists by crew position that reference other crew aids to get started in performing common pre-sortie, execution, and post-sortie actions in a standardized manner. Note that this is not an exhaustive list of all of the Crew Aids that exist in the repository.
Select your crew position:
- Mission Element Lead
- Host Analyst
- Network Analyst
- Intel Analyst
- Network Technician
Select your current mission/sortie phase:
- PLANNING
- PRE-SORTIE OPS CHECK
- EXECUTION AIDS
- POST-SORTIE ACTIVITIES
Documents and procedures that may aid the Mission Element Lead/Mission Planning Cell Chief during mission planning.
Refer to the following:
- 262COS-PRE-AID-001 - Mission Planning Cell Guide
- Review the guide prior to MPC, and reference during planning
- 262COS-PRE-AID-002 - Host Data Collection Planning
- Perform host agent deployment planning
- Perform active host data collection planning
- 262COS-PRE-AID-003 - Network Sensor Deployment Planning
- Perform network sensor placement planning
- 262COS-IA-AID-001 - ATT&CK Technique Coverage Visualization
- Perform Visualizing Detection Coverage procedures when a visual of the CPT's active detection capabilities needs to be presented
- Perform Visualizing Adversary Techniques procedures when a visual of a list of a threat's MITRE ATT&CK techniques needs to be presented
- Perform Visualizing Coverage Gaps procedures when a visual of a list of a threat's MITRE ATT&CK techniques that WILL NOT be detected by the CPT's active detection capabilities needs to be presented
- Perform Visualizing Adversary Detection Coverage procedures when a visual of a list of a threat's MITRE ATT&CK techniques that MAY be detected by the CPT's active detection capabilities needs to be presented
- INITIAL PRE-SORTIE CHECKLIST
- DAILY PRE-SORTIE CHECKLIST
Procedures that must be performed by the Mission Element Lead prior to the FIRST sortie of a mission.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
- Review all crew-member statuses for inclusion in the pre-sortie brief and Pre-Sortie ORM calculation
- Report
#on-stationin the RocketChataccountabilitychannel - Prepare the Pre-Sortie Brief
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel - 262COS-PRE-CL-001 - ORM Worksheets (Pre-Sortie)
- After all ORM scores are collected, calculate the sortie risk for inclusion in the pre-sortie brief and perform appropriate risk acceptance actions
Weapon System Ops Check
- 262COS-MIP-SOP-001 - CVA/H 3.8 MIP Setup
- Perform an initial MIP setup according to sortie-specific parameters set by the MEL and SPINS
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Cold-Start)
- Verify that the MIP has been correctly setup according to sortie-specific parameters set by the MEL and SPINS
Post-Admin Actions
- Brief the Pre-Sortie Brief to the Mission Element
- Announce
#startexin the RocketChataccountabilitychannel at VULN start
Procedures that must be performed by the Mission Element Lead prior to each sortie.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
- Review all crew-member statuses for inclusion in the pre-sortie brief and Pre-Sortie ORM calculation
- Report
#on-stationin the RocketChataccountabilitychannel - Prepare the Pre-Sortie Brief
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel - 262COS-PRE-CL-001 - ORM Worksheets (Pre-Sortie)
- After all ORM scores are collected, calculate the sortie risk for inclusion in the pre-sortie brief and perform appropriate risk acceptance actions
Weapon System Ops Check
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Warm-Start)
- Verify that the MIP is still operational and configured according to sortie-specific parameters set by the MEL and SPINS
Post-Admin Actions
- Brief the Pre-Sortie Brief to the Mission Element
- Announce
#startexin the RocketChataccountabilitychannel at VULN start
Documents and procedures that may aid the Mission Element Lead during sortie execution.
Refer to the following:
Analysis & Alert Triage
- 262COS-ELK-AID-001 - Custom Dashboard Reference
- Review this document if you are unfamiliar with 262COS/DOK Kibana dashboards
- 262COS-OPS-SOP-003 - Elastic Detection Alert Triage
- Triage and investigate Elastic Detection Alerts as they occur
Other References
- 262COS-HA-SOP-003 - Remote Host Interaction
- Reference when remotely interacting with hosts during execution (WinRM, SMB, SSH, Impacket, RDP, file transfer)
- 262COS-HA-SOP-004 - Windows Host Clear Actions
- Execute clear actions against compromised Windows hosts when authorized by the MEL
- 262COS-HA-SOP-006 - Forensic Disk Image Cloning
- Reference when forensic disk imaging or image mounting of a target host is required
- 262COS-NA-SOP-003 - Wardriving
- When authorized, perform an attack surface assessment by discovering wireless access points into the DAL
- 262COS-NA-AID-002 - Tool Fundamentals - Nmap
- Reference for Nmap scanning procedures when conducting ad-hoc discovery or targeted enumeration
- 262COS-MIP-SOP-002 - CVA/H DIP on a MIP Operation
- Reference when operating DIP components (Elastic, Zeek, Suricata, Arkime) directly on the MIP without a full DIP deployment
Procedures that must be performed by the Mission Element Lead at the end of sortie or mission execution.
Perform the following:
- 262COS-COMM-SOP-001 - Crewlog Export
- Export crewlogs in preparation for post-sortie debrief
- 262COS-POST-SOP-001 - Sortie Debriefing
- Lead the post-sortie debrief
Select your current mission/sortie phase:
- PLANNING
- PRE-SORTIE OPS CHECK
- EXECUTION AIDS
- POST-SORTIE ACTIVITIES
Documents and procedures that may aid the Host Analyst SME during mission planning.
Refer to the following:
- Review the guide prior to MPC, and reference during planning
- Perform host agent deployment planning
- Perform active host data collection planning
- INITIAL PRE-SORTIE CHECKLIST
- DAILY PRE-SORTIE CHECKLIST
Procedures that must be performed by the Host Analyst prior to the FIRST sortie of a mission.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel
Weapon System Ops Check
- 262COS-MIP-SOP-001 - CVA/H 3.8 MIP Setup
- Perform an initial MIP setup according to sortie-specific parameters set by the MEL and SPINS
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Cold-Start)
- Verify that the MIP has been correctly setup according to sortie-specific parameters set by the MEL and SPINS
- 262COS-MS-CL-001 - Metasponse Server Setup Verification
- Verify that the Metasponse Server has been correctly configured (only one individual needs to perform)
- 262COS-MS-SOP-001 - Metasponse Client Setup
- Install a current version of Metasponse on the MIP's Windows VM
- Configure the MIP's Metasponse in either a Standalone or Semi-Centralized configuration
- 262COS-MS-SOP-002 - Metasponse Job Template Setup
- Configure Metasponse Job templates on the Windows Server (only one individual needs to perform)
- Also configure Metasponse Job templates on MIPs in a Standalone configurations
- 262COS-EG-CL-001 - Endgame Ops Check
- Verify that Endgame has been correctly configured and licensed (only one individual needs to perform)
- 262COS-EG-SOP-001 - Endgame Sensor Setup
- Configure Endgame sensor Policies and Profiles (only one individual needs to perform)
Post-Admin Actions
- Report
#on-stationin the RocketChataccountabilitychannel - Attend or review the Pre-Sortie Brief
- Wait for the
#startexmessage in the RocketChataccountabilityfrom the MEL to begin sortie execution
Procedures that must be performed by the Host Analyst prior to each sortie.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel
Weapon System Ops Check
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Warm-Start)
- Verify that the MIP is still operational and configured according to sortie-specific parameters set by the MEL and SPINS
Post-Admin Actions
- Report
#on-stationin the RocketChataccountabilitychannel - Attend or review the Pre-Sortie Brief
- Wait for the
#startexmessage in the RocketChataccountabilityfrom the MEL to begin sortie execution
Documents and procedures that may aid the Host Analyst during sortie execution.
Refer to the following:
Host Agent Deployment
- 262COS-NA-SOP-001 - Baseline Network Scanning
- Perform a Remote management port scan against the DAL to identify viable host agent targets
- Do not forget to also export your scans to Elastic
- copy the result files to
\\fileserver\MISSION\03_EXECUTION\03_NETWORK_SCANS\(/cvah/share/MISSION/03_EXECUTION/03_NETWORK_SCANS/) - Test authentication credentials against DAL assets manually, or by executing a job using the Metasponse
DISCOVERYjob template - Be careful when testing credentials at mass, as you may lock-out the credentials if incorrect
- 262COS-HA-SOP-004 - CVAH Host Agent Deployment
- Deploy host agents against verified targets with open management ports - otherwise you will significantly slow down the deployment
Vulnerability & Compliance Scanning
- 262COS-OPS-SOP-002 - ACAS Scanning
- Configure network infrastructure Policy Compliance Auditing Scan Policies using known DAL network infrastructure models, verions, and applicable compliance frameworks
- Initiate vulnerability scans against DAL network infrastructure
- Do not forget to also export your scans to Elastic
- Generate PDF exports and copy them to
\\fileserver\MISSION\03_EXECUTION\04_VULNERABILITY_SCANS\(/cvah/share/MISSION/03_EXECUTION/04_VULNERABILITY_SCANS/)
Analysis & Alert Triage
- 262COS-OPS-AID-001 - Baseline Inventory Analysis
- Collect data and begin the baseline inventory process
- 262COS-ELK-AID-001 - Custom Dashboard Reference
- Review this document if you are unfamiliar with 262COS/DOK Kibana dashboards
- 262COS-OPS-SOP-003 - Elastic Detection Alert Triage
- Triage and investigate Elastic Detection Alerts as they occur
Host Agent Configuration
- 262COS-HA-AID-001 - Sysmon Config Tuning
- Tune Sysmon XML configurations on deployed hosts to reduce noise while maintaining detection coverage
- 262COS-HA-AID-002 - Winlogbeat Config Tuning
- Reference when configuring or modifying Winlogbeat on Windows endpoints to adjust channel coverage or event ID filtering
- 262COS-HA-AID-003 - Filebeat Config Tuning
- Reference when configuring Filebeat on Linux or Windows endpoints to collect log files and application logs
Analysis References
- 262COS-HA-AID-004 - PowerShell Deobfuscation
- Reference when analyzing obfuscated PowerShell scripts encountered during alert triage or host analysis
- 262COS-HA-AID-005 - Tool Fundamentals - Volatility
- Reference for memory forensics analysis using Volatility 2/3 - process analysis, malware detection, credential extraction, and network triage
- 262COS-HA-SOP-007 - Forensic Artifact Analysis
- Reference when performing forensic analysis of disk images or memory dumps to identify artifacts and reconstruct timelines
- 262COS-HA-SOP-008 - Convert Disk Images into VMs
- Reference when converting a raw disk image (.img, .dd) into a bootable VMware VM for live forensic analysis
Other References
- 262COS-HA-SOP-003 - Remote Host Interaction
- Reference when remotely interacting with hosts during execution (WinRM, SMB, SSH, Impacket, RDP, file transfer)
- 262COS-HA-SOP-004 - Windows Host Clear Actions
- Execute clear actions against compromised Windows hosts when authorized by the MEL
- 262COS-HA-SOP-006 - Forensic Disk Image Cloning
- Reference when forensic disk imaging or image mounting of a target host is required
- 262COS-NA-AID-002 - Tool Fundamentals - Nmap
- Reference for Nmap scanning procedures during host agent deployment reconnaissance
- 262COS-MIP-SOP-002 - CVA/H DIP on a MIP Operation
- Reference when operating DIP components (Elastic, Zeek, Suricata, Arkime) directly on the MIP without a full DIP deployment
Procedures that must be performed by the Host Analyst at the end of sortie or mission execution.
Perform the following:
- 262COS-POST-SOP-001 - Sortie Debriefing
- Participate in the post-sortie debrief
Select your current mission/sortie phase:
- PLANNING
- PRE-SORTIE OPS CHECK
- EXECUTION AIDS
- POST-SORTIE ACTIVITIES
Documents and procedures that may aid the Network Analyst SME during mission planning.
Refer to the following:
- 262COS-PRE-AID-001 - Mission Planning Cell Guide
- Review the guide prior to MPC, and reference during planning
- 262COS-PRE-AID-003 - Network Sensor Deployment Planning
- Perform network sensor placement planning
- INITIAL PRE-SORTIE CHECKLIST
- DAILY PRE-SORTIE CHECKLIST
Procedures that must be performed by the Network Analyst prior to the FIRST sortie of a mission.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel
Weapon System Ops Check
- 262COS-MIP-SOP-001 - CVA/H 3.8 MIP Setup
- Perform an initial MIP setup according to sortie-specific parameters set by the MEL and SPINS
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Cold-Start)
- Verify that the MIP has been correctly setup according to sortie-specific parameters set by the MEL and SPINS
- 262COS-DIP-CL-001 - CVA/H 3.8 DIP Ops Check (Cold-Start)
- Verify that the DIP has been correctly configured according to sortie-specific parameters set by the MEL and SPINS - this MUST be perfomed with a CMR operator since it is a matter of Weapon System safety
- 262COS-DIP-SOP-004 - CVA/H DIP Sensor Configuration
- Initialize Zeek, Suricata, and Arkime on each avtive sensor and configure their
HOME NETaccording to sortie-specific parameters set by the MEL and SPINS - Assign and synchronize ETPRO rulesets for each sensor with Suricata installed
Post-Admin Actions
- Report
#on-stationin the RocketChataccountabilitychannel - Attend or review the Pre-Sortie Brief
- Wait for the
#startexmessage in the RocketChataccountabilityfrom the MEL to begin sortie execution
Procedures that must be performed by the Network Analyst prior to each sortie.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel
Weapon System Ops Check
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Warm-Start)
- Verify that the MIP is still operational and configured according to sortie-specific parameters set by the MEL and SPINS
Post-Admin Actions
- Report
#on-stationin the RocketChataccountabilitychannel - Attend or review the Pre-Sortie Brief
- Wait for the
#startexmessage in the RocketChataccountabilityfrom the MEL to begin sortie execution
Documents and procedures that may aid the Network Analyst during sortie execution.
Refer to the following:
Network Discovery Scanning
- 262COS-NA-SOP-001 - Baseline Network Scanning
- Perform a Basic TCP port scan against the DAL
- Do not forget to also export your scans to Elastic
- copy the result files to
\\fileserver\MISSION\03_EXECUTION\03_NETWORK_SCANS\(/cvah/share/MISSION/03_EXECUTION/03_NETWORK_SCANS/)
Vulnerability & Compliance Scanning
- 262COS-OPS-SOP-002 - ACAS Scanning
- Configure host Policy Compliance Auditing Scan Policies using known DAL OS verions, software, and applicable compliance frameworks
- Initiate vulnerability scans against DAL hosts
- Do not forget to also export your scans to Elastic
- Generate PDF exports and copy them to
\\fileserver\MISSION\03_EXECUTION\04_VULNERABILITY_SCANS\
Analysis & Alert Triage
- 262COS-OPS-AID-001 - Baseline Inventory Analysis
- Collect data and begin the baseline inventory process
- 262COS-ELK-AID-001 - Custom Dashboard Reference
- Review this document if you are unfamiliar with 262COS/DOK Kibana dashboards
- 262COS-OPS-SOP-003 - Elastic Detection Alert Triage
- Triage and investigate Elastic Detection Alerts as they occur
Other References
- 262COS-NA-SOP-003 - Wardriving
- When authorized, perform an attack surface assessment by discovering wireless access points into the DAL
- 262COS-NA-AID-002 - Tool Fundamentals - Nmap
- Reference for Nmap usage during network discovery, targeted enumeration, and firewall evasion techniques
- 262COS-MIP-SOP-002 - CVA/H DIP on a MIP Operation
- Reference when operating DIP components directly on the MIP without a full DIP deployment
TAP Setup References
- 262COS-NA-SOP-004 - Gigamon TAP Setup
- Reference when deploying a Gigamon GTP-ASF01 TAP for passive traffic capture between two network devices
- 262COS-NA-SOP-005 - TAP with MIP
- Reference when configuring the MIP itself as a transparent TAP using the DAWSON method - no additional hardware required
- 262COS-NA-SOP-006 - Garland TAP Setup
- Reference when deploying a Garland INT1G10CSASP TAP for passive traffic capture
Procedures that must be performed by the Network Analyst at the end of sortie or mission execution.
Perform the following:
- 262COS-POST-SOP-001 - Sortie Debriefing
- Participate in the post-sortie debrief
Select your current mission/sortie phase:
- PLANNING
- PRE-SORTIE OPS CHECK
- EXECUTION AIDS
- POST-SORTIE ACTIVITIES
Documents and procedures that may aid the Intel Analyst SME during mission planning.
Refer to the following:
- 262COS-PRE-AID-001 - Mission Planning Cell Guide
- Review the guide prior to MPC, and reference during planning
- 262COS-IA-AID-001 - ATT&CK Technique Coverage Visualization
- Perform Visualizing Detection Coverage procedures when a visual of the CPT's active detection capabilities needs to be presented
- Perform Visualizing Adversary Techniques procedures when a visual of a list of a threat's MITRE ATT&CK techniques needs to be presented
- Perform Visualizing Coverage Gaps procedures when a visual of a list of a threat's MITRE ATT&CK techniques that WILL NOT be detected by the CPT's active detection capabilities needs to be presented
- Perform Visualizing Adversary Detection Coverage procedures when a visual of a list of a threat's MITRE ATT&CK techniques that MAY be detected by the CPT's active detection capabilities needs to be presented
- INITIAL PRE-SORTIE CHECKLIST
- DAILY PRE-SORTIE CHECKLIST
Procedures that must be performed by the Intel Analyst prior to the FIRST sortie of a mission.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel
Weapon System Ops Check
- 262COS-MIP-SOP-001 - CVA/H 3.8 MIP Setup
- Perform an initial MIP setup according to sortie-specific parameters set by the MEL and SPINS
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Cold-Start)
- Verify that the MIP has been correctly setup according to sortie-specific parameters set by the MEL and SPINS
Post-Admin Actions
- Report
#on-stationin the RocketChataccountabilitychannel - Attend or review the Pre-Sortie Brief
- Wait for the
#startexmessage in the RocketChataccountabilityfrom the MEL to begin sortie execution
Procedures that must be performed by the Intel Analyst prior to each sortie.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel
Weapon System Ops Check
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Warm-Start)
- Verify that the MIP is still operational and configured according to sortie-specific parameters set by the MEL and SPINS
Post-Admin Actions
- Report
#on-stationin the RocketChataccountabilitychannel - Attend or review the Pre-Sortie Brief
- Wait for the
#startexmessage in the RocketChataccountabilityfrom the MEL to begin sortie execution
Documents and procedures that may aid the Intel Analyst during sortie execution.
Refer to the following:
Detection Engineering
- 262COS-ELK-SOP-001 - Elastic Detection Rule Creation
- Create Custom Query, Indicator Match, and Threshold detection rules in Kibana based on adversary TTPs or intelligence requirements
- 262COS-ELK-SOP-002 - Sigma to Elastic Detection Rule Conversion
- Batch convert Sigma rules to Elastic Detection rules when working from published threat intelligence or detection repositories
- 262COS-ELK-SOP-005 - Initial Exception List Whitelisting
- Build and manage Elastic Security exception lists to suppress known-good activity and reduce false positive alert volume
Analysis & Triage
- 262COS-OPS-SOP-003 - Elastic Detection Alert Triage
- Triage and investigate Elastic Detection Alerts - escalate findings with supporting context to the MEL
- 262COS-IA-AID-001 - ATT&CK Technique Coverage Visualization
- Perform Visualizing Coverage Gaps when new threat intelligence identifies techniques not currently covered by active detection rules
- Perform Visualizing Adversary Detection Coverage when providing the MEL a coverage picture against the assessed threat
Procedures that must be performed by the Intel Analyst at the end of sortie or mission execution.
Perform the following:
- 262COS-POST-SOP-001 - Sortie Debriefing
- Participate in the post-sortie debrief
Select your current mission/sortie phase:
- PLANNING
- PRE-SORTIE OPS CHECK
- EXECUTION AIDS
- POST-SORTIE ACTIVITIES
Documents and procedures that may aid the Network Technician SME during mission planning.
Refer to the following:
- 262COS-PRE-AID-001 - Mission Planning Cell Guide
- Review the guide prior to MPC, and reference during planning
- 262COS-PRE-AID-003 - Network Sensor Deployment Planning
- Perform network sensor placement planning
- INITIAL PRE-SORTIE CHECKLIST
- DAILY PRE-SORTIE CHECKLIST
Procedures that must be performed by the Network Technician prior to the FIRST sortie of a mission.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel
Weapon System Ops Check
- 262COS-MIP-SOP-001 - CVA/H 3.8 MIP Setup
- Perform an initial MIP setup according to sortie-specific parameters set by the MEL and SPINS
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Cold-Start)
- Verify that the MIP has been correctly setup according to sortie-specific parameters set by the MEL and SPINS
- 262COS-DIP-CL-001 - CVA/H 3.8 DIP Ops Check (Cold-Start)
- Verify that the DIP has been correctly configured according to sortie-specific parameters set by the MEL and SPINS - this MUST be perfomed with a CMR operator since it is a matter of Weapon System safety
Post-Admin Actions
- Report
#on-stationin the RocketChataccountabilitychannel - Attend or review the Pre-Sortie Brief
- Wait for the
#startexmessage in the RocketChataccountabilityfrom the MEL to begin sortie execution
Procedures that must be performed by the Network Technician prior to each sortie.
Review the following:
- 262COS-EP-SOP-001 - CVAH Emergency Procedures
- Review the document as well as any mission specific procedures given by the MEL or SPINS
- 262COS-COMM-AID-001 - Internal Comms
- Review the document as well as any mission specific communication contracts given by the MEL or SPINS
Perform the following:
Pre-Admin Actions
- Verify status and review all new Crew Information Files (CIFs) in ePEX (https://legacy.omni.af.mil/ePex/Login)
ORM Assessment
- 262COS-PRE-CL-001 - ORM Worksheets (Personal)
- Record personal ORM scores (Format:
#orm A:<SCORE>/B:<SCORE>) in the RocketChataccountabilitychannel
Weapon System Ops Check
- 262COS-MIP-CL-001 - CVA/H 3.8 MIP Ops Check (Warm-Start)
- Verify that the MIP is still operational and configured according to sortie-specific parameters set by the MEL and SPINS
- 262COS-DIP-CL-001 - CVA/H 3.8 DIP Ops Check (Warm-Start)
- Verify that the DIP is still operational and configured according to sortie-specific parameters set by the MEL and SPINS
Post-Admin Actions
- Report
#on-stationin the RocketChataccountabilitychannel - Attend or review the Pre-Sortie Brief
- Wait for the
#startexmessage in the RocketChataccountabilityfrom the MEL to begin sortie execution
Documents and procedures that may aid the Network Technician during sortie execution.
Refer to the following:
TAP / Sensor Deployment
- 262COS-NA-SOP-004 - Gigamon TAP Setup
- Deploy and configure a Gigamon GTP-ASF01 TAP for passive traffic capture; verify SFP compatibility before implementing on mission partner systems
- 262COS-NA-SOP-005 - TAP with MIP
- Configure the MIP as a transparent TAP using the DAWSON method when dedicated TAP hardware is unavailable
- 262COS-NA-SOP-006 - Garland TAP Setup
- Deploy and configure a Garland INT1G10CSASP TAP for passive traffic capture; verify SFP compatibility before implementing on mission partner systems
- 262COS-DIP-SOP-004 - CVA/H DIP Sensor Configuration
- Initialize Zeek, Suricata, and Arkime on active sensors and configure HOME_NET per MEL/SPINS parameters
- Assign and synchronize ETPRO rulesets for each sensor with Suricata installed
Other References
- 262COS-HA-SOP-003 - Remote Host Interaction
- Reference when remotely accessing the DIP, sensors, or other infrastructure (SSH, SMB, file transfer)
- 262COS-NA-AID-002 - Tool Fundamentals - Nmap
- Reference for Nmap when verifying sensor placement or confirming network segment reachability
Procedures that must be performed by the Network Technician at the end of sortie or mission execution.
Perform the following:
- 262COS-POST-SOP-001 - Sortie Debriefing
- Participate in the post-sortie debrief
Crew Aid Repository Info
- This repository contains all 262COS/DOK developed and/or vetted SOPs (Standard Operating Procedures), Aids, Checklists, and other Crew Aid related materials
- The Crew Aids are hosted locally on the MIP by a Docusarus Docker container running via the
crewaidservice. - This repository exists locally on the MIP under the
/cvah/git/CREW_AIDSfolder and can be modified IAW 262COS-GIT-SOP-002