The platform you inherited: measure it before you touch it Start this lab

Why this matters

"The virtual machines are slow" is a symptom with at least four different causes underneath it, and they leave different fingerprints: time spent waiting for a core, memory taken back from inside the guests, memory pushed to disk, and storage taking longer to answer. Reading those four figures turns an argument into a diagnosis.

Concepts

Objectives graded

• Read the Performance tab before changing anything and write down the three figures that are out of line.
• Separate the symptoms — wait time, reclaimed memory, storage response — from the one cause underneath them.
• Turn a guest off before resizing it; the platform refuses otherwise, and the refusal is the lesson.
• Put each guest back to a size the work needs and spread them across both hosts.
• Add the second path to the datastores and note which figure it moves and which it does not.
• Read every figure you filed at the start once more and close with the before-and-after pair.

MITRE ATT&CK coverage

Reading a hypervisor's real load — which host carries what, how oversubscribed it is, where the storage goes — is the same enumeration an intruder does after landing on a management seat, and the figures are the ones that decide whether a complaint is capacity or compromise.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A reversible action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The platform was worked in the console rather than described from the ticket.

  investigation · weight 15

• The complaint was pinned to a named host rather than left as 'the VMs'.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• Contention was measured as wait time, which is the figure that matches the complaint.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The cause of the wait was quantified, not just observed.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The memory symptom was found before it turned into swapping.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The storage symptom was measured and tied to the same cause.

  investigation · weight 10 · T1046 Network Service Discovery (Discovery)

• The fix was verified by re-reading the figure that started the complaint.

  configuration · weight 15 · T1078 Valid Accounts (Defense Evasion)

Common mistakes

• Treating the four symptoms as four problems instead of asking what single decision produced them.
• Resizing a guest that is running and concluding the platform is broken when it refuses.
• Quoting utilization as evidence of contention when wait time is the figure that shows it.
• Declaring success without reading the opening figure again.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.