SOC › Module 6 › Lesson 4
Lab — Triage
Triage lab on $SOC_LAB — process card, FP/TP table, enrichment checklist on sample alert pack.
Visual · t29_triage_lab
Lab: triage pack on YOUR $SOC_LAB sample alerts. Original Cyberlium.
Opening
Ship triage artifacts from YOUR sample alert pack — process, disposition, enrichment — zero unauthorized SIEM or attack generation.
On YOUR $SOC_LAB per brief: (1) scope proof — sample alert pack name and source labeled; (2) triage process card five stages with checkpoints; (3) FP vs TP classification table for ≥3 sample alerts with reason fields; (4) enrichment checklist applied to one alert with asset/user/TI stub/related rows; (5) disposition summary UTC with observed vs inferred separated; (6) integrity block — $SOC_LAB only, no unauthorized SIEM, no attack-generated alerts; (7) chmod 600 pack. Use instructor synthetic alerts or lab CSV export — NOT prod employer queue, NOT running phishing/malware/brute to populate queue.
1. Lab deliverables
Process + FP/TP + enrichment cross-indexed to one alert pack source.
Saved alert snippets redacted in share-safe copy; mentor pack chmod 600.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Alert queue hygiene — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final Elastic alerts — https://www.elastic.co/guide/en/security/current/alerts-ui.html Splunk notable events — https://docs.splunk.com/Documentation/ES
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/notes/triage-queue-summary.txt" <<'EOF'
YOUR alert queue triage summary:
ALR-001: FP — jsmith typo (internal IP, has success event)
ALR-002: TP — external admin brute (203.0.113.50) — ESCALATE
ALR-003: TP — phishing block (bob) — user awareness ticket
ALR-004: FP/info — scheduled task (alice) — verify change ticket
All alerts: YOUR seeded alerts.json — document FP/TP rationale
EOFCommand — copy this
jq 'length' "$SOC_LAB/logs/alerts.json" grep -E 'ALR-|TP|FP' "$SOC_LAB/notes/triage-queue-summary.txt"
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t29-soc/notes/triage-queue-summary.txt | Select-String ALR Get-Content $HOME/cyberlium-lab/t29-soc/logs/alerts.json | Select-String ALR-002
Primary tools to practice this lesson: jq, grep. Reference sites: Alert queue hygiene (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Elastic alerts (https://www.elastic.co/guide/en/security/current/alerts-ui.html); Splunk notable events (https://docs.splunk.com/Documentation/ES). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Label sample vs synthetic source — separate evidence classes.
No real employee PII from unauthorized sources in pack.
3. Teardown
Secure notes chmod 600; delete temp exports if brief requires.
No lab dispositions pushed to real ticketing system without approval.
4. What you ship: triage lab pack
Process + FP/TP + enrichment + disposition + integrity — chmod 600.
5. What you record before the next lesson
Triage lab pack path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Triage lab includes brute-force run against classmate account to fill queue.
Right
Triage lab pack on $SOC_LAB sample alerts. Next: quiz.
Mission: triage lab
1) Scope and alert pack proof. 2) Process and FP/TP rows. 3) Enrichment checklist on one alert. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum alert count if brief sparse?”
Knowledge Check
APPLY: Triage lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Running attacks to populate triage lab is OK.
True or False
Knowledge Check
APPLY: Disposition summary should:
Multiple choice