Detection Intake

Detection intake literacy names alert sources, triage fields, and escalation criteria — practice intake forms on YOUR $IR_LAB tabletop alerts.

Detection Intake• Audio Walkthrough

00:00/03:23

Visual · t34_detection_intake

Detection intake literacy. $IR_LAB only. Original Cyberlium.

Every incident starts as a signal — literacy teaches intake triage so tabletop alerts enter IR with consistent fields you document.

Detection intake captures how alerts and reports enter IR — SIEM rules, EDR detections, user reports, threat intel matches. Triage fields include timestamp, source, affected asset, initial severity guess, and assigned analyst. Escalation criteria tie to severity matrix — e.g., lateral movement observed triggers IC page. Cyberlium practices intake on YOUR $IR_LAB — write intake row for three fictional tabletop alerts. Next: Analysis Named.

1. Intake components (named)

Sources: SIEM correlation, EDR alert, phishing report, vuln scanner, ISAC feed — lab-labeled on $IR_LAB. Triage fields: time, source, asset, technique hint, preliminary severity. Routing: SOC tier-1 vs IR tier-2 vs hunt queue.

On $IR_LAB, write intake row — alert ID, source, asset placeholder, triage decision for fictional inject.

Command guide

Try these commands — Intake components (named)

═══ LINUX / BASH (SOC Analyst Triage) ═══

Filter system logs for security-relevant warnings and errors

Command — copy this

journalctl -p 3 -xb --no-pager | head -20

Search for suspicious persistent cron entries or service changes

Command — copy this

ls -lat /etc/cron.* /etc/systemd/system/ | head -15

═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)

Command — copy this

Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -Wrap

Check open listening network connections with process owners

Command — copy this

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort

Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS IR (https://www.sans.org/for-organizations/incident-response/); CISA (https://www.cisa.gov/stopransomware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why intake literacy reduces duplicate tickets and missed escalations

Incomplete intake sends analysts hunting without asset context. Missing escalation criteria delay IC involvement on true P1s. Standard forms speed tabletop and production consistency.

Students triage lab alerts on notes — production intake follows ticketing and SOAR automation.

3. Lab boundary

Forbidden: intake rows with live victim PII or stranger-network asset IDs without scope. Allowed: detection intake card — three fictional alerts with triage fields on $IR_LAB.

Ship: detection intake card for YOUR lab alerts. Next: Analysis Named.

4. What you ship: detection intake card for $IR_LAB

Three fictional alert intake rows with triage fields. $IR_LAB named. chmod 600.

5. What you record before the next lesson

Date. Detection intake card. $IR_LAB named. File t34-m04-l01-detection-intake.txt chmod 600.

6. Wrong vs right: stranger networks vs YOUR IR tabletop

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Skip triage fields and escalate everything to IC. Paste live victim alert exports into lab.
Right: Write detection intake card for YOUR $IR_LAB. Next: Analysis Named.

Hands-on Exercise