Blue team challenges: from alert to incident
You triage realistic alerts in a SIEM, weed out false positives, confirm real incidents with evidence and write the missing detection yourself.
Level 301 · 14 lessons · 12 practice labs
Lessons
Alert triage
- A brute-force alert: real or a test?
- An impossible-travel alert
- A phishing email reported by an employee
- An antivirus alert and checking the quarantine
- Short task: label four alerts as true, false or benign positives
Confirming with evidence
- Enriching the indicators
- Confirming an attack from the endpoint process tree
- Showing an account logged on to other machines
- Confirming a large data outflow
- Short task: write the escalation note for the confirmed incident
Writing the missing detection
- A Sigma rule for the behaviour that slipped through
- Tuning a noisy rule with an exception
- Testing the rule against sample events
- Capstone: clear a shift's queue, confirm the incident and ship the new rule
Practice labs
- New admin account alert: an approved change?: You check a new admin account alert against the change records, decide whether it was approved and write your verdict and its basis to the result file.
- Assess an alert about repeated approval prompts: You review the records of an account that received many second-factor prompts overnight and write whether a login succeeded and your classification to the result file.
- Group ten alerts into incidents and prioritise them: You sort the ten alerts in Karabatak Denizcilik's queue into incidents by merging duplicates and write the priority order with reasons to the result file.
- Did the flagged download actually run?: From endpoint records you determine whether the file behind an alert was run after download and submit the flag in the evidence line.
- Find who queried a newly registered domain: You find from the logs the machine that queried a newly registered domain and the process that started the query and write them to the result file.
- Prove a service account was used by hand: You extract from the logs the machines and times at which an account meant only for automated jobs logged on interactively and write the evidence summary to the result file.
- Write a rule for a success after many failures: You write a threshold rule catching a successful login after a run of failures and produce the result file showing it fires on the sample events.
- Catch a scheduled task created by an unusual tool: You write a rule catching a scheduled task created by a program other than the admin tool and write the match count on the sample events to the result file.
- Catch log clearing and auditing being switched off: You write a rule for log clearing and audit shutdown, test it on sample events and document the sources of false alerts in the result file.
- Write the shift handover note: From the state of the queue you write a handover note summarising open, pending and closed work as the result file.
- Prepare containment advice for a confirmed incident: For a confirmed account takeover at Sedef Kuyumculuk you write evidence-based containment steps and their business impact to the result file.
- Map rules to techniques and find the blind spot: You map the existing detection rules to a table of attack techniques and write the most important technique with no rule, with your reasoning, to the result file.
About this course
You triage realistic alerts in a SIEM, weed out false positives, confirm real incidents with evidence and write the missing detection yourself.
What you will learn
- Alert triage
- Confirming with evidence
- Writing the missing detection
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.