Security monitoring basics: alerts, events, cases
You start without knowing what a security operations centre does and learn with simple examples the difference between events, alerts and cases, how to take a first look and how to ask the right question.
Level 101 · 13 lessons · 12 practice labs
Lessons
Core ideas
- Events, alerts, cases and security incidents
- Confidentiality, integrity, availability and monitoring
- What traces attackers leave
- Short task: sort ten records into events, alerts or cases
The first look
- Five questions: who, what, where, when, how
- Looking up IPs and domains: whois and reputation
- Looking up a file hash
- What a false alarm is and why it happens
- Short task: look at a login alert with the five questions
Communication
- Writing analysis notes: short, evidenced, time-stamped
- When and whom to notify
- A day in the life of a SOC analyst
- Capstone: investigate three alerts, write notes and escalate one
Practice labs
- Sort ten records into events, alerts or cases: Place the ten records in the queue simulator into the right class and write a one-sentence reason for each.
- Decide which security goal an alert threatens: Sort eight alerts under confidentiality, integrity and availability and pick with a reason the most serious one for Lavinya Klinikleri.
- Merge scattered alerts into a single case: Show that five separate alerts about one user and host belong to a single chain, open the case and explain which alert is unrelated.
- Look at a login alert with the five questions: Fill in who, what, where, when and how from the records for a successful login alert raised at night.
- Find which record you need for an alert with a missing answer: See that the how question is unanswered for a file deletion alert, work out which log source would answer it and get the answer from that record.
- Reconcile contradicting answers from two sources: Where the VPN log and the application log give a different place and time for one session, find the truth by accounting for time zone and address translation.
- Look up the registration and reputation of an address and a domain: Use the lab’s built-in whois and reputation tools to note an address’s owner, a domain’s age and its reputation score.
- Calculate a file’s hash and compare it with the known list: Calculate the SHA-256 of three files, look them up in the lab’s known-bad and known-good lists and write a verdict for each.
- Find and prove the cause of a false alarm: Show with timing, account and target evidence that a mass file access alert fired nightly by backup software is legitimate, and write a tuning suggestion.
- Turn a rambling analysis note into a short, time-stamped one: Cut a long note down to five lines under what was seen, what was done and next step, adding a time to each line.
- Decide who needs to know about an alert and notify them: Use the escalation matrix to decide which team is told about three alerts and how fast, and write the notification for one of them.
- Investigate three alerts, write notes and escalate one: Investigate three queued alerts with evidence, close two with reasons, escalate the third as a case and write a note that leaves the next person nothing to ask.
About this course
You start without knowing what a security operations centre does and learn with simple examples the difference between events, alerts and cases, how to take a first look and how to ask the right question.
What you will learn
- Core ideas
- The first look
- Communication
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.