L2 · Collection & Managed Attribution ⚠ LIVE / QUARANTINED
Taught once — but this shelf is perishable. Concepts (why isolate a host, what a sock puppet is for, chain of custody) are durable; specific tools, sites, and SOPs rot fast (operator notes major shifts since 2024). This shelf is operator-led with live research, not distilled from Claude’s memory.
Quarantine rules
- Every card carries a
last-verified: YYYY-MM-DDline. - Tool/site names live in the dated appendix L2-99, never baked into card bodies — so a tooling refresh never forces a rewrite of the durable concept cards.
- Built from web research + operator ground truth; Claude drafts the stable concept scaffold only.
Cards
| ID | Card |
|---|---|
| L2-01 | Managed attribution — concept & the attribution stack |
| L2-02 | Virtual machines & host isolation |
| L2-03 | Sock puppets / covert accounts |
| L2-04 | Source types — surface / deep / dark |
| L2-05 | Breach & leak data exploitation |
| L2-06 | Capture, preservation & chain of custody (stable) |
| L2-99 | Current tooling register — dated appendix |
Status & sources: course-architecture §3.