Defensive › Module 5 › Lesson 3
Alert Hygiene
Alerts that fire on signal, not noise — design on $LAB_HOST telemetry only.
Visual · alert_hygiene
Alert hygiene literacy. $LAB_HOST telemetry. Original Cyberlium.
Opening
An alert nobody trusts is worse than silence — tune on YOUR lab before dreaming of SOC glory.
Alert hygiene means thresholds, deduplication, severity, runbooks, and ownership so on-call responds to real incidents. Defenders tune rules on telemetry they understand — auth burst on owned servers, not ping from the moon. Cyberlium teaches writing one alert rule description for $LAB_HOST — not paging your roommate when their PC sneezes or flooding Slack with café DHCP events. Next: Logging Lab.
1. Signal, severity, owner
Each alert needs: what fired, why it matters, severity, who owns response, and link to runbook. Example on $LAB_HOST: five failed SSH logins in five minutes from one IP.
Alerts without owners become noise everyone ignores — defender anti-pattern.
Command guide
Try these commands — Signal, severity, owner
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma rules — https://sigmahq.io/ (detection rule literacy) Alert fatigue — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu):
macOS:
Windows:
═══ LINUX / macOS ═══
Command — copy this
journalctl -n 200 --no-pager 2>/dev/null | grep -ciE 'error|fail|denied' || echo 'Count noisy patterns on YOUR lab logs' journalctl -n 50 --no-pager 2>/dev/null | grep -vE 'systemd|dbus' | head -10 || tail -10 /var/log/syslog 2>/dev/null
Primary tools to practice this lesson: journalctl, grep. Reference sites: Sigma rules (https://sigmahq.io/); Alert fatigue (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tune before scale
Baseline normal on lab first. Adjust threshold until false positives drop. Production SOC teams spend weeks tuning — you practice the habit on disposable logs.
Pointing alerts at stranger infrastructure you do not operate is out of scope.
3. Runbook one-liner
Write: If alert X on $LAB_HOST, then verify Y, contain Z, escalate if W. Ship alert description + runbook stub. Next: Logging Lab.
4. What you ship: one alert rule + runbook stub for $LAB_HOST
Alert condition, severity, owner, runbook one-liner. Lab telemetry only. chmod 600.
5. What you record before the next lesson
Date. Alert rule description for $LAB_HOST. File t16-m05-l03-alert-hygiene.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Alert on every packet on dorm subnet. Page class Discord for any Windows Update.
Right
Write one tuned alert description for $LAB_HOST. Next: Logging Lab.
Mission: alert rule design
1) Write one alert condition for $LAB_HOST logs. 2) Assign severity and owner (you). 3) Add runbook one-liner. Never alert on stranger systems.
Stuck? Ask Cyberlium AI Mentor
Start with auth failure burst — high signal on owned SSH with low stranger risk.
Knowledge Check
APPLY: Alert hygiene requires:
Multiple choice
Knowledge Check
APPLY: True or False: False positive floods improve security culture.
True or False
Knowledge Check
APPLY: Tuning alerts on $LAB_HOST first:
Multiple choice