SOC › Module 6 › Lesson 3
Enrichment
Enrichment literacy — asset context, user role, threat intel category, related alerts — on $SOC_LAB sample data only.
Visual · t29_enrichment
Enrichment = named context layers. $SOC_LAB literacy. Original Cyberlium.
Opening
An alert without context is a headline — name enrichment sources on YOUR sample rows before you escalate anything.
Enrichment literacy names: asset inventory lookup (hostname, owner, criticality), user context (role, department, recent auth), threat intel category (known-bad IP/domain hash at literacy level — not live attacker infrastructure probing), related alert correlation in same $SOC_LAB timeframe, and geo/time baseline. Analyst documents enrichment steps taken on sample alert — uses lab-provided context tables or instructor TI stubs — without querying stranger threat feeds aggressively, without OSINT doxing real employees, without pivoting into unauthorized prod AD. Cyberlium on $SOC_LAB enrichment worksheet paired with Module 6-1 triage stages. Refused: scanning stranger networks from alert IOC, harassing users named in logs, prod SIEM pivot without RoE. Lab row: enrichment checklist (asset, user, TI stub, related alerts) with one honest N/A allowed.
1. Enrichment layers
Asset, user, intel stub, related alerts — four literacy anchors per triage row.
Enrichment informs FP/TP — does not replace disposition documentation.
Command guide
Try these commands — Enrichment layers
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE T1110 — https://attack.mitre.org/techniques/T1110/ Sigma failed logon — https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security NIST enrichment — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
echo '=== Enrich ALR-002 with auth.jsonl ==='
jq -c 'select(.src_ip=="203.0.113.50")' "$SOC_LAB/logs/auth.jsonl"
cat > "$SOC_LAB/notes/triage-worksheet-ALR-001.md" <<'EOF'
# Triage Worksheet — ALR-001
- User jsmith, 3 failures from 10.0.5.88 — same host as successful logon from 10.0.2.10
- Likely: user typo or stale session — possible FP
- FP/TP: [x] FP (lab context: internal IP, user has success event)
- Action: close as FP, notify user to reset password if repeats
EOFCommand — copy this
grep -E 'FP|jsmith' "$SOC_LAB/notes/triage-worksheet-ALR-001.md"
Primary tools to practice this lesson: jq, grep. Reference sites: MITRE T1110 (https://attack.mitre.org/techniques/T1110/); Sigma failed logon (https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security); NIST enrichment (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender hygiene
Use approved TI sources and CMDB stubs in lab; redact PII in share-safe copies.
Stop when scope unclear — escalate rather than unauthorized pivot.
3. Refused
No active scanning of IOCs against stranger infrastructure; no prod AD queries without RoE.
Enrichment literacy supports triage — not unauthorized investigation expansion.
4. What you ship: enrichment checklist row
Four enrichment layers + sample alert application + NEVER unauthorized pivot line.
5. What you record before the next lesson
Enrichment checklist row path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Ping-scan every IP from lab alert against the public internet as 'enrichment.'
Right
Enrichment checklist from $SOC_LAB sample alert. Next: Triage Lab.
Mission: enrichment checklist row
1) Name four enrichment layers. 2) Apply checklist to one lab alert. 3) Separate observed vs inferred. 4) Write NEVER unauthorized pivot line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Related alerts — same user or same host first?”
Knowledge Check
APPLY: Enrichment on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Scanning IOCs against stranger networks is lab.
True or False
Knowledge Check
APPLY: Enrichment helps:
Multiple choice