Lab 2.2 — Alert Anatomy

Lab Overview

The Scenario

You've just started your first solo shift as a Tier 1 SOC analyst. Your shift lead hands you a printed card: "For the first hour, don't action anything. Just read alerts. Understand their structure. By the end of the hour, you should be able to look at any alert and instantly know: what happened, where, when, how bad, and what to do next."

Your Wazuh environment has 505 pre-loaded alerts from a realistic 24-hour period across 4 systems. Your job is to select 10 alerts of varying severity, dissect each one field-by-field, and build a reference card you'll use for the rest of the course.

Part 1: Navigate to the Alert Queue

Step 1: Open Security Events

After starting your lab and logging into the Wazuh Dashboard (admin / SecretPassword), navigate to the alert queue:

1. Click Modules in the left sidebar
2. Select Security Events
3. You should see a table of alerts sorted by timestamp

Step 2: Understand the Alert Table Columns

The default table shows a summary view. Each row is one alert with these key columns:

Part 2: The 8 Critical Fields

Every Wazuh alert contains dozens of fields, but SOC analysts consistently check these 8 first. Click on any alert to expand it and find each field.

Click to enlarge

Part 3: Analyze 10 Alerts

You'll now select and analyze 10 alerts — at least 2 from each severity tier. Use the filters in the Wazuh Dashboard to find alerts at each level.

Finding Alerts by Severity

Use the search bar to filter by severity:

rule.level: 15

rule.level: >= 12 AND rule.level: <= 14

rule.level: >= 8 AND rule.level: <= 11

rule.level: >= 4 AND rule.level: <= 7

Alert 1-2: Critical Severity (Level 12-15)

Find two alerts at level 12 or above. These represent the most dangerous events in your environment.

For each alert, fill in this template:

ALERT #___
─────────────────────────────
Rule ID:          [e.g., 5712]
Rule Description: [e.g., "SSHD brute force trying to get access"]
Rule Level:       [e.g., 15]
Agent:            [e.g., linux-web-01]
Timestamp:        [exact time from the alert]
Source:           [IP or username that caused it]
Target:           [IP, user, or file affected]
full_log summary: [first 100 characters of the raw log]

ANALYST ASSESSMENT:
- What happened?  [one sentence]
- Is this normal?  [Yes/No + why]
- What would I do? [Investigate / Tune / Escalate / Close]

Alert 3-4: High Severity (Level 8-11)

Find two alerts at level 8-11. These are suspicious events that need investigation but aren't necessarily confirmed threats.

Fill in the same template for each. Pay attention to: Is the source IP internal or external? Is the target account a service account or a human?

Alert 5-6: Medium Severity (Level 4-7)

Find two alerts at level 4-7. These are often policy violations, configuration issues, or low-confidence detections.

Fill in the same template. Ask yourself: Would this alert add value during an active incident investigation, even though it's not high-severity on its own?

Alert 7-8: Informational (Level 0-3)

Find two informational alerts. These are typically agent heartbeats, successful operations, or system status messages.

Fill in the same template. Ask yourself: Under what circumstances would this "noise" alert suddenly become important? (Hint: absence of heartbeats = agent is down = possible tampering.)

Alert 9-10: Your Choice — Most Interesting Alerts

Browse the full alert queue and pick the two alerts you find most interesting or unusual. They can be any severity level.

Fill in the same template, but add one extra field:

WHY I PICKED THIS: [What caught your attention?]

Part 4: Compare Across Agents

Now that you've analyzed 10 alerts, compare the alert patterns across the 4 agents in your environment:

Click to enlarge

Step: Agent-Level Analysis

For each agent, search for its alerts:

agent.name: linux-web-01

Answer these questions:

1. How many total alerts does this agent have?
2. What is the highest severity alert?
3. What rule fires most frequently? (Use the rule.id field to count)

Repeat for all 4 agents and record in a comparison table.

Part 5: Build Your Alert Anatomy Reference Card

Using your 10 analyzed alerts, create a one-page reference card with:

1. Field Quick Reference: The 8 critical fields and where to find them
2. Severity Guide: What each level means and your expected response
3. Agent Baseline: Normal alert patterns for each of the 4 agents
4. Red Flags: 3 patterns you noticed that would make you investigate immediately

Deliverable Checklist

Before completing the lab, ensure you have:

• 10 Alert Analysis Worksheets — complete templates for all 10 alerts with all 8 fields extracted
• Severity Representation — at least 2 alerts from each of the 4 severity tiers
• Agent Comparison Table — alert count, highest severity, and most frequent rule per agent
• Alert Anatomy Reference Card — one-page summary with field reference, severity guide, agent baselines, and red flags

What's Next

In Lab 2.3 — Build a SOC Dashboard, you'll take the alert data you've been exploring and build custom visualizations. Instead of reading alerts one by one, you'll create dashboards that give you an instant picture of your environment's security posture — the same dashboards SOC managers check every morning.