I built Host Triage as a progressive project because the learning problem itself unfolds in stages. A first-year cyber student rarely fails triage by missing a definition. They fail by grabbing the wrong host first, skipping a log, or treating every alert like it matters equally. That is a judgment problem under time pressure. A quiz on "what is triage" does not catch it. A short Open Cyber Range scenario that forces them to pick an order, leave a trail, and say why does.
Module 4's readings and the ATD capability model gave me language for decisions I was already making by feel. What follows is the rationale: what the project is trying to do, which standards it touches, and how the Module 4 sources shaped the next cut.
What Host Triage is for
Host Triage sits inside Cyber Defense I as Scenario 1 on the Open Cyber Range. Students get a small network, a handful of hosts that look differently wrong, and a clock. The job is not "find every IOC." The job is: decide where to look first, collect just enough evidence, and hand off a clean story to whoever comes next. That maps to real SOC and IR work more honestly than a worksheet that asks for the definition of PPP.
I am treating it as progressive work in the sense Glaser and colleagues describe when they unpack design considerations across learner, tech, and pedagogy layers (Glaser et al., 2023). Students move through stages of the same problem with more ambiguity each time, not through disconnected topics. Early on they might name the host that looks most wrong. Later passes add log noise, a dead-end lead, and a write-up that has to survive a peer review. Same scenario family. Harder judgment.
ATD and the standards I am actually using
I am not mapping every letter of every framework. I am using three ATD layers the way they show up in this lab, plus the Module 4 standards that ask for project scope, planning tools, and collaborative feedback culture (Association for Talent Development, n.d.).
Personal. Curiosity and learning agility matter here more than tool fluency. Students who treat triage as a checklist get stuck when the obvious host is clean. The personal capability I want visible is: stay with the problem when the first guess fails. That shows up in the reflection prompt after the scenario, not in a multiple-choice item about curiosity.
Professional. Instructional design and learning technologies are the professional lane I am working in. Coaching shows up as the paired pressure-test in the reinforce stage: one student owns the host order, the other asks hard questions about the evidence note. The OCR lab, the MkDocs workbook, and the Canvas checkpoint are the delivery surface. Assessment design keeps the scenario from becoming theater. Students produce an ordered host list, a short evidence note, and a handoff sentence. Those artifacts are what I score.
Organizational. Change management and culture-of-feedback sit one level up. Host Triage only earns its keep if the rest of the cyber sequence can reuse the same judgment pattern: alert, prioritize, evidence, handoff. I am writing it so Scenario 2 can inherit the same rubric language instead of inventing a new one. The project-management board is where that culture gets practiced: students see scope, blockers, and feedback as part of the work, not as a separate "soft skills" unit.
On accessibility I am staying with the WCAG / POUR checklist from Module 3. Module 4 does not get a new compliance layer. The progressive project should not quietly undo that work.
Inquiry questions that drove the read
Before I went deep on the PDFs I wrote four questions tied to the Module 4 standards:
- How do I keep Host Triage progressive without turning every week into a new unit?
- Where does partnership or coaching belong inside a solo-looking triage lab?
- How should AI assist my design work without rewriting what "good triage" means?
- What planning surface lets learners practice community-facing outcomes while I still ship Scenario 1 on time?
Those questions framed the notes below.
How the Module 4 readings moved the design
Schmidt, Earnshaw, Jahnke, and colleagues (2024) on entangled eclecticism. Their sociotechnical-pedagogical systems framing matches how Host Triage actually gets built. Pedagogy (judgment under time pressure), tech (OCR + MkDocs + Canvas), and social context (pair review, later community outreach via the PM board) are tangled on purpose. I am not picking one theory and forcing the lab to wear it. I am naming the tangle and keeping each layer visible in the artifacts.
Glaser, Thull, Schmidt, and colleagues (2023) on LXD design considerations. Even though their review focuses on spherical video VR for autistic learners, the move I stole is the explicit unpack of sociocultural, technological, and pedagogical considerations. For Host Triage that means: sociocultural = pair pressure-test and eventual community handoff language; technological = OCR as the live surface, MkDocs as the brief, Canvas as the gradeable drop; pedagogical = thinning scaffolds on the same triage skill. Progressive design here means the hint about which signal usually matters disappears in later passes. The core skill stays.
Lin, Garcia, Nasir, and Sultana (2024) on ChatGPT for project-management dynamics. Their SITE paper is about simulating PM and software-development dynamics in online higher education. I am not putting students into a fake Scrum theater. I am using the same idea: a project-management environment where roles, tasks, and feedback are visible. For Host Triage, the LXD PM board (Trello first, with Asana as a backup option) is where Scenario 1 development work lives, and where a community-outreach card tracks how learners practice handoff language with an external audience (for example, a short brief for a campus SOC student worker or a local ISAC-style tabletop partner). The Custom GPT prompt for that board is built to keep it honest: scope, blockers, and community touchpoints stay on the board, not only in my head.
Sakulviriyakitkul, Sintanakul, and Srisomphan (2020) on project-based learning and Agile teamwork. Their design for promoting teamwork with PBL and Agile concepts pushed me to put an explicit collaboration beat inside Host Triage. The reinforce stage now includes a short paired review. One student owns the order; the other pressure-tests the evidence note. That is Agile-flavored feedback without forcing a full sprint ceremony onto a 75-minute lab.
Nilmanee, Sintanakul, and Sakulviriyakitkul (2024) on an LXP with xAPI and design thinking. The useful takeaway for me was the reminder that experience platforms drift unless the learning loop is designed. Host Triage already spans OCR, MkDocs, Canvas, Drive, and Figma. My rule for the progressive project: one source of truth for the scenario brief (MkDocs), one place for the gradeable artifact (Canvas), one place for the live environment (OCR). The PM board tracks work. Everything else is support. Design-thinking language shows up in how I frame the midterm outlines: empathize with the first-year learner under alert load, define the triage judgment problem, prototype the three artifacts, test with a peer pressure-test.
What I am not claiming
I am not claiming Host Triage is finished. The midterm work right now is about prompts and outlines so I can keep building without starting over every Sunday. I am also not claiming the ATD model replaces TAMU-CC outcomes. It is a lens. Where it helps me name a gap, like the missing partnership beat in an early draft, I use it. Where it would force a fake mapping, I leave it alone.
Next cut
Aligned assessments lock the three artifacts (order, evidence note, handoff) to observable criteria. The midterm package locks a Custom GPT prompt and two outlines so the progressive project has a project-management spine. This post is the why. The rest of the packet is the how.
References
Association for Talent Development. (n.d.). Talent development capability model. https://td.org/capability-model
Glaser, N., Thull, C., Schmidt, M., et al. (2023). Learning experience design and unpacking sociocultural, technological, and pedagogical design considerations of spherical video-based virtual reality systems for autistic learners: A systematic literature review. Journal of Autism and Developmental Disorders. https://doi.org/10.1007/s10803-023-06168-3
Lin, W., Garcia, M., Nasir, M., & Sultana, A. (2024). Beyond traditional teams: Using ChatGPT to simulate project management dynamics and software development in online higher education. In J. Cohen & G. Solano (Eds.), Proceedings of SITE 2024 (pp. 2123-2129). AACE. https://www.learntechlib.org/primary/p/224269/
Nilmanee, T., Sintanakul, K., & Sakulviriyakitkul, P. (2024). The design of a learning experience platform using xAPI with design thinking learning to promote innovation. International Journal of Emerging Technologies in Learning (iJET), 19(1), 54-67. https://www.learntechlib.org/p/224939/
Sakulviriyakitkul, P., Sintanakul, K., & Srisomphan, J. (2020). The design of a learning process for promoting teamwork using project-based learning and the concept of Agile software development. International Journal of Emerging Technologies in Learning (iJET), 15(3), 207-222. https://www.learntechlib.org/p/217016/
Schmidt, M., Earnshaw, Y., Jahnke, I., et al. (2024). Entangled eclecticism: A sociotechnical-pedagogical systems theory approach to learning experience design. Educational Technology Research and Development, 72, 1483-1505. https://doi.org/10.1007/s11423-024-10353-1