The Northgate Reference Environment

Introduction

Every figure across the previous eight sections came from somewhere. Almost none of it came from a real compromised estate, and that is a choice worth explaining rather than leaving implicit.

Saying where is not a formality in a course that spends its time insisting evidence carries its provenance. A text that asks a reader to state what every claim rests on and does not do so itself has undercut the argument before the reader reaches the second module.

Two environments are in play and they do different jobs. The technique work happens in your own lab, on machines you build and can break, and that is where every command in this course is meant to be run. The fictional estate carries the scenarios and the situations a small lab cannot produce.

Keeping them apart matters more in this course than in most. Nothing in these modules queries a shared dataset; every measurement is a command against a host, which means the reader's lab is the working environment and the fiction is scaffolding around it.

Sharing it across courses is what makes the estate worth building. A fiction used once is scenery; one that a reader meets again in a Windows course or a detection course becomes somewhere they already know, and the second course starts further along than it otherwise could.

You will finish able to say which of the two environments a given example belongs to, what the fictional one is for, and why its published figures get corrected in place rather than defended.

The size matters more than it looks. Eight hundred staff is large enough to have segmentation, a service desk and change control, and small enough that one person can plausibly know every server, which is the scale where most of these techniques are actually practiced.

Northgate Engineering is an eight hundred and ten person engineering company, and its Linux estate is the part this course uses.

$ cat ne-linux-roster.txt
  RHEL 9.3, 6 hosts
    SRV-NGE-MCR-APP01   ERP
    SRV-NGE-MCR-APP02   API
    SRV-NGE-MCR-DB01    PostgreSQL
    SRV-NGE-MCR-DB02    PostgreSQL
    SRV-NGE-BRS-DB01    DR replica
    SRV-NGE-MCR-MON01   monitoring
  Ubuntu 24.04, 2 hosts
    WEB-NGE-MCR-01      nginx
    WEB-NGE-MCR-02      nginx
  network
    FW-NGE-MCR-01       Palo Alto PA-3220
    PRX-NGE-MCR-01      Squid proxy

Eight Linux servers across two distributions. The Windows and identity machines exist in the estate and are somebody else's course. Two sites, a primary at MCR and a secondary at BRS, and the naming carries the site so any hostname in an example places itself.

That convention does real work across the modules. A lateral movement example that crosses sites is visible from the hostnames alone, and a reader does not have to be told which machines are meant to be near each other.

Counting them separately is a rule the platform enforces rather than a convenience. A total that collapses identity infrastructure into a general server count produces a figure no two courses agree on, which is the precise failure the recount below corrected.

The mix is deliberate rather than decorative. Six of one distribution and two of another means examples can show where paths, package tooling and defaults diverge, which a single-distribution estate would hide entirely.

The two distributions differ in ways that matter to almost every module. Package tooling, default paths, which persistence mechanisms exist and how logs are configured all diverge, and a course set on one distribution would teach half of each answer without saying so.

The fictional estate does two jobs your lab cannot, and no others worth claiming.

It carries the scenarios. Every judgment exercise in this course hands you a report somebody filed and asks what is wrong with it, and that needs an organization, a host and a person who made a decision. None of that can come off a machine you built yesterday.

It also carries the multi-host cases. The same key on none of forty-one other web servers, a clean-build baseline for a host class, a trust graph across eight machines: a lab with two virtual machines cannot construct any of those, and they are real investigative moves rather than decoration.

The argument for a reference environment is not realism. It is that numbers in different places can be compared.

Five sections and one host. Nothing forced that; it is what happens once a shared estate exists. A reader can carry web01 from section to section, and a figure that disagrees with another is visible rather than hidden behind unrelated examples.

The alternative is what most technical writing does. Each section invents whatever machine suits its example, every example is internally fine, and nothing in the whole body of work can ever be checked against anything else in it.

That is also what makes errors findable. Two unconnected examples can both be wrong forever; two examples about the same machine disagree out loud, which is how the recount described below came about.

Unrelated examples have no way to disagree. Each one is internally consistent, none of them constrains any other, and a wrong figure can sit in a body of teaching material indefinitely because nothing in it ever contradicts anything else.

Stating the costs rather than only the benefits is the point of the card. A teaching environment presented as though it had no limitations invites a reader to expect their own estate to behave like it, and the gap between the two is where most of the surprises live.

That note is the distinction worth carrying out of this section.

It is also the answer to an obvious objection. A reader who notices that the course is set in an invented company might reasonably wonder whether any of it is real, and the answer is that the numbers are and the names are not.

There is a reason to describe that correction in a course rather than only fixing it quietly, and it is not modesty. The way a figure gets corrected is the same discipline the rest of this course asks for on evidence: count the thing, replace what disagrees, and say how much drift remains.

A reader who has watched a number be recounted has seen the method applied to the material they are reading. That is a stronger demonstration than any amount of instruction about claiming the reading rather than the host.

It also sets an expectation about the rest. Anything in this course carrying a number was either measured or copied from something countable, and a reader is entitled to ask which and to find the answer stated.

The scenario above describes something that actually happened to this environment.

Six lines describing a correction rather than a defense. The second line names the date and the thing it was counted against. The old figure was not defended, reconciled or explained away; it was recounted against the thing it was supposed to describe and replaced.

Both of those details are what make it a correction rather than an edit. A figure that changes with no date and no source is indistinguishable from somebody having preferred a different number.

The drift figure is the honest part. Twenty-four files still carry the old number, the spec says so plainly, and a reader meeting one of them can tell it is known rather than wondering whether they have misread something.

Naming the drift is a different act from fixing it. Fixing twenty-four files is a campaign with its own risk, and stating that twenty-four exist lets any reader who meets one recognize it immediately at no cost at all.

Drawing the corpus, the published figure and the content files as a chain is the shape worth keeping. Each step is a copy of the one before it, copies drift at different rates, and the arrow that fixes the problem runs backwards to the only thing that can be counted.

The dashed arrow runs backwards for a reason. A published figure is a copy of something countable, so when the two disagree the copy is what changes.

It is also the only arrow in the diagram that is ever traversed twice. Counting happens once when a figure is first published and again whenever somebody suspects drift, and the second traversal is what this section is really about.

Seeing how the disagreement resolves is worth the space beforehand, because the resolution is mechanical rather than editorial. Nobody argues about which module is better written; something countable is counted.

One framing before the exercise. Meeting two figures that disagree is uncomfortable in a teaching text, and the alternative is worse: a course that reconciles its own contradictions quietly teaches a reader that contradictions get reconciled quietly.

Six lines and the third is the one that decides it. The other five are bookkeeping around a single count. Neither module is consulted about which is right; the corpus is counted, and whichever figure disagrees with it is the one that changes.

The exercise above gives you two figures from the same environment that disagree.

Nothing in this course queries a shared dataset, which is worth stating because several courses on this platform do.

Every LX technique is a command against a host. Reading a process directory, timing a collection, counting persistence mechanisms and checking a mount option are all things you run in your own lab, and none of them has a fictional version that would teach anything.

The estate is invented and most of what the course measures inside it is not.

Keeping those apart is the single most important thing to take from this section. A reader who treats the figures as part of the story will not check any of them, and the figures are the half that rewards checking and transfers to their own work.

Every timing in this module was taken on a real Linux host. The 13.64 millisecond collection, the process table losing 77 entries in four seconds, the 773 configuration files and the zero-size readings are all measurements that can be reproduced on any machine you have.

Your numbers will differ and that is the intended result. A host with more processes takes longer to walk, a quieter one loses fewer entries per second, and the method is what transfers rather than any particular figure.

Two rows invented and two measured. Nothing in the invented pair carries a technique. The second pair is what transfers to your estate, and the first pair is what makes the course readable.

The file paths row is the one readers most often assume is invented. Those are the actual locations on an actual platform, and a reader who treats them as part of the story will look for the real ones and find the same paths.

The fiction supplies the setting. Hostnames, the intrusion narrative, the people and the dates are invented so that examples cohere, and none of them is load-bearing for any technique.

Six reproducible figures and two invented ones. The reproducible ones outnumber the invented ones, which is the right proportion. The line between them is worth knowing, because a reader who assumes everything is invented will not bother checking, and the figures are the part that rewards checking.

The proportion is worth checking in any technical material. A text where the invented setting carries more weight than the measurements is teaching a story, and one where the measurements dominate is teaching a method that happens to have a setting.

A handful of named roles recur across the platform, and they exist so that decisions have owners.

$ cat who-decides.txt
  Rachel Okafor    CISO              whether to accept the risk of staying up
  Phil Greaves     IT director       whether a service goes offline
  Tom Ashworth     L1 analyst        usually the responder in these scenarios
  Priya Sharma     L1 analyst        the second pair of eyes
  Marcus Webb      architect         receives what the estate should change
  Elena Petrova    governance        receives what has to be reported
  note             the top two own decisions the investigation does not

Seven lines and the last is why the list exists. Naming an owner is what stops a decision being described in the passive voice.

Rachel Okafor is the CISO and Phil Greaves is the IT director. Between them they own the decisions LX0.7 described as belonging to the business rather than to the investigation, and naming them stops those decisions being narrated in the passive voice.

Both appear at moments where the investigation has to stop and ask. That is deliberate: several sections of this module end with a decision that is not the responder's to make, and having somebody to hand it to keeps that boundary visible.

Tom Ashworth and Priya Sharma are first-line analysts. They are usually the people in the scenarios, which is deliberate: most of the mistakes in this course are made by competent people following reasonable advice.

That choice runs through every scenario in this module. None of the mistakes in the previous eight sections was made by somebody careless; each was made by following advice that is correct in a context other than the one they were in.

Marcus Webb is the security architect and Elena Petrova covers governance. They appear where a finding has to reach somebody who will act on it, which LX9.9 established is a different document from the evidence.

Those two matter most at the end of an investigation rather than during one. An architect receives what the estate should change and a governance lead receives what has to be reported, and both are audiences the evidence has to be translated for.

One more thing the named people do that is easy to miss, because it looks like set dressing. Giving a decision an owner forces the course to say who makes it, and a surprising number of security texts avoid that question entirely.

Whether to take a production service offline is the clearest case. LX0.7 established that the business owns that risk rather than the investigation, and naming a CISO and an IT director is what stops the text sliding into the passive voice about it.

The same applies to who receives a finding. A handover written to nobody in particular ends up describing evidence rather than answering somebody, and a named architect or governance lead is a reminder that a report has a reader with a decision to make.

A reference environment is a teaching device, and it is worth reading with a little suspicion.

Six comparisons and not one figure agrees. The method transferred completely and the numbers did not, which is the relationship this section is about.

Check the figures on your own machines. Every measurement in this module is a command away, and running one of them is the difference between accepting a number and knowing it.

Running one is enough to change how the rest reads. A reader who has watched their own process table lose entries between two readings has a different relationship to every claim in this course than one who has only been told.

Expect your estate to be messier. Northgate has eight Linux servers with consistent names and no undocumented history, and a real estate will have hosts nobody can account for, which is a category this fiction cannot teach.

The undocumented host is the specific gap. Northgate has eight Linux servers and somebody knows about all eight; most real estates have machines nobody can account for, and finding those is a discipline this fiction has no way to teach.

Check the date on anything that carries a figure. A number with no date attached cannot be placed against a recount, which is the difference between a stale figure somebody can identify and one that simply confuses people.

And treat a contradiction as a finding rather than a misreading. Two figures from the same environment that disagree mean one of them is stale, that is how the server count was caught, and reporting it is more useful than working around it.

The useful version of this is not Northgate. It is the same document for the estate you actually work on.

Northgate exists to show the shape of the thing rather than to be it. Everything the fiction supplies about its own estate is a worked example of a document a reader could hold about theirs, and the fictional version is worth nothing on a real incident.

Almost every readiness exercise in this module produces part of it. The destination table from LX0.7, the persistence baseline from LX0.6, the retention figures from LX0.3 and the acquisition feasibility from LX9.6 are each one enumeration, and together they are a reference environment for real hosts.

That was not planned when the exercises were written. Each was offered because it answers a question somebody would otherwise answer badly during an incident, and collecting them together turns out to be most of a reference document.

$ cat our-estate.txt
  HOST CLASSES        web, app, db, monitoring, jump
  PER CLASS
    collection cost   timed, per class
    persistence       mechanisms present, and the clean-build baseline
    log retention     per log, with the window each covers
    acquisition       which interfaces exist, per class
    destination       does the collector reach this segment
  RECORDED            date, and the build image it describes
  REBUILD WHEN        the image changes

Six categories and none of them needs an incident. Each maps to a readiness exercise from an earlier section. Every one is a question somebody can answer on a quiet afternoon, and every one is a question that gets answered badly under pressure.

The collection cost is the one worth doing first. It takes minutes, it produces the figure that makes every later argument about time concrete, and LX0.7 showed what it is worth when somebody has to negotiate for access to a host.

The last two lines are what stops it rotting. A reference document with no date and no rebuild trigger becomes exactly the superseded figure this section is about, which is a failure mode this platform has demonstrated in public.

A dated document that is wrong is still useful, which is the part people miss. Somebody can see it describes a build image from eighteen months ago and discount it accordingly, where an undated one gets trusted or discarded on instinct.

Practice

There is a version of this exercise worth running before anything else in the course, because it is the one that pays regardless of whether an incident ever happens. Build the six-category document above for one host class, and time how long it takes.

It is usually an afternoon for the first class and far less for the next. Most of the work is deciding what a host class is and where the answers live, and once that is settled each additional class is a repeat of the same enumerations.

What it produces is the thing Northgate is standing in for. Every figure in this course exists to show what such a document contains, and the version describing your own estate is worth more than the fiction in every respect except readability.

Pick one measurement from this module and run it in your lab. The figure will differ from anything printed here and the method will not, which is the whole relationship between the two environments.

One thing to carry forward. Nine sections have described what this course teaches, and a course is defined as much by what it leaves to somebody else, which is the last thing an orientation owes a reader.

The environment is now established. What this course will not settle, and which other courses own those questions, is LX0.10.