Module 4: Alert Triage — The Core Skill
SOC analysts do this 80% of the time. Get fast. Get accurate.
7 lessons · 6 labs
Triage Operation APT Breach alerts under time pressure — separate the campaign from scanner noise and false positives.
Path
- Lesson01
Lesson 4.1 — True Positive vs False Positive
Fast classification patterns
- Lab02Intermediate
Lab 4.1 — Triage Under Pressure
Work a shift queue by level and finding, collapse it, and scope each finding back to where it started.
- Lesson03
Lesson 4.2 — Context Is Everything
Asset value, user role, time of day
- Lab04Intermediate
Lab 4.2 — Investigate Suspicious Logon
Start from one vague brief about the domain controller: set aside the VPN password spray it only validates, find which intrusions got past its failures and what each did, then write a verdict and a scope for each.
- Lesson05
Lesson 4.3 — Investigation Workflow
Alert → pivot → decide
- Lesson06
Lesson 4.4 — Decoding & Deobfuscation
Base64, PowerShell with CyberChef
- Lab07Intermediate
Lab 4.3 — Decode the Payload
Browser-only: decode Base64, URL-encoded and hex payloads with CyberChef. No cloud lab needed; checking a decode against Wazuh is optional.
- Lesson08
Lesson 4.5 — Escalation: When and How
What, when, who to escalate
- Lab09Advanced
Lab 4.4 — Alert Queue Challenge
A full 2,000-alert shift: prioritize by finding, let intel raise priority, scope back, write the handoff.
- Lesson10
Web Attack Signatures in Logs
Recognizing SQLi, XSS, Command Injection, and Path Traversal patterns in web server logs and SIEM alerts
- Lab11Intermediate
Lab 4.5 — Web Attack Alert Triage
Classify 37 web attack alerts on linux-web-01 by type (reconnaissance, SQLi, XSS, command injection, path traversal, web shell), separate scanner noise from targeted attacks, and write an escalation summary.
- Lesson12
Lesson 4.7 — Recognizing Anomalies: The Analyst's Mental Model
Seven anomaly categories — masquerading, frequency, temporal, location, structure, entropy, absence — with SOC examples
- Lab13Advanced
Lab 4.6 — Anomaly Detection Challenge
Hunt for anomalies hidden among normal Wazuh activity, classify each by category, then work two plain-English hypotheses in the unmatched event stream where no rule ever fired.