Incident › Module 4 › Lesson 1
Detection Intake
Detection intake literacy names alert sources, triage fields, and escalation criteria — practice intake forms on YOUR $IR_LAB tabletop alerts.
Visual · t34_detection_intake
Detection intake literacy. $IR_LAB only. Original Cyberlium.
Opening
Every incident starts as a signal — literacy teaches intake triage so tabletop alerts enter IR with consistent fields you document.
Detection intake captures how alerts and reports enter IR — SIEM rules, EDR detections, user reports, threat intel matches. Triage fields include timestamp, source, affected asset, initial severity guess, and assigned analyst. Escalation criteria tie to severity matrix — e.g., lateral movement observed triggers IC page. Cyberlium practices intake on YOUR $IR_LAB — write intake row for three fictional tabletop alerts. Next: Analysis Named.
1. Intake components (named)
Sources: SIEM correlation, EDR alert, phishing report, vuln scanner, ISAC feed — lab-labeled on $IR_LAB. Triage fields: time, source, asset, technique hint, preliminary severity. Routing: SOC tier-1 vs IR tier-2 vs hunt queue.
On $IR_LAB, write intake row — alert ID, source, asset placeholder, triage decision for fictional inject.
Command guide
Try these commands — Intake components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final SANS IR — https://www.sans.org/for-organizations/incident-response/ CISA — https://www.cisa.gov/stopransomware
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/detection/intake-form-template.md" <<'EOF'
# Incident Intake Form — YOUR template
- **Reporter:** name/team
- **Detection source:** SOC alert / user report / SIEM / EDR / third party
- **First observed (UTC):** timestamp
- **Affected assets:** hostname/IP (YOUR org inventory only)
- **Initial symptoms:** encrypted files / beacon / cred abuse / data leak
- **Severity (draft):** Sev 1–4 per severity-matrix.md
- **Immediate actions taken:** none / isolated lab host / blocked IP
- **Evidence preserved:** logs / snapshot / email headers
Lab: fill with LAB-IR-RANSOM-001 fictional data
EOFCommand — copy this
grep -E 'Detection source|Severity|LAB-IR' "$IR_LAB/detection/intake-form-template.md" curl -sS https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS IR (https://www.sans.org/for-organizations/incident-response/); CISA (https://www.cisa.gov/stopransomware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why intake literacy reduces duplicate tickets and missed escalations
Incomplete intake sends analysts hunting without asset context. Missing escalation criteria delay IC involvement on true P1s. Standard forms speed tabletop and production consistency.
Students triage lab alerts on notes — production intake follows ticketing and SOAR automation.
3. Lab boundary
Forbidden: intake rows with live victim PII or stranger-network asset IDs without scope. Allowed: detection intake card — three fictional alerts with triage fields on $IR_LAB.
Ship: detection intake card for YOUR lab alerts. Next: Analysis Named.
4. What you ship: detection intake card for $IR_LAB
Three fictional alert intake rows with triage fields. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Detection intake card. $IR_LAB named. File t34-m04-l01-detection-intake.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip triage fields and escalate everything to IC. Paste live victim alert exports into lab.
Right
Write detection intake card for YOUR $IR_LAB. Next: Analysis Named.
Mission: triage intake on YOUR lab alerts
1) List five intake sources. 2) Write intake rows for three fictional alerts. 3) Note escalation trigger per row. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Asset and time on every row — intake without context wastes the next analyst.
Knowledge Check
APPLY: Detection intake primarily captures:
Multiple choice
Knowledge Check
APPLY: True or False: Escalation criteria should tie to severity matrix thresholds.
True or False
Knowledge Check
APPLY: Detection intake literacy on Cyberlium uses:
Multiple choice