SOC › Module 6 › Lesson 1
Triage Process
Alert triage process literacy — queue, severity, context, disposition — on YOUR $SOC_LAB sample alerts, not stranger SIEM access.
Visual · t29_triage_process
Triage process = named SOC workflow stages. $SOC_LAB sample alerts. Original Cyberlium.
Opening
Every alert queue hides signal and noise — name the triage process on YOUR sample alerts before you call anything true positive.
Alert triage process literacy names SOC workflow stages defenders use: alert intake from SIEM queue, severity and rule context read, initial enrichment (Module 6-3), false-positive vs true-positive decision (Module 6-2), ticket or escalate path, and documented disposition with UTC timestamp. Analyst works instructor $SOC_LAB sample logs and synthetic alerts — understands rule name, source host, user, and MITRE tag at literacy level — without accessing employer or stranger production SIEM without authorization. Cyberlium on $SOC_LAB: your sample alert CSV, lab Splunk/Elastic export, or instructor triage board. Refused: live SIEM on systems you do not own, suppressing alerts to hide incidents, running phishing/malware/brute attacks to 'generate alerts.' Lab row: five triage stages with one defender checkpoint each. chmod 600 under $HOME/cyberlium-lab.
1. Named triage stages
Intake → context read → enrichment → FP/TP decision → ticket/disposition — five literacy anchors.
Each stage maps to shift hygiene: queue SLA, analyst notes, handoff readiness.
Command guide
Try these commands — Named triage stages
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Alert triage — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final Elastic alert workflow — https://www.elastic.co/guide/en/security/current/alerts-ui.html FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install python3
macOS:
Command — copy this
brew install jq brew install python3
Windows:
Command — copy this
choco install jq
Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/logs/alerts.json" <<'EOF'
[
{"id":"ALR-001","severity":"high","title":"Multiple failed logons","user":"jsmith","src_ip":"10.0.5.88","host":"WIN-LAB01","count":3,"mitre":"T1110.001","status":"new"},
{"id":"ALR-002","severity":"critical","title":"Admin logon failures from external IP","user":"administrator","src_ip":"203.0.113.50","host":"WIN-LAB01","count":2,"mitre":"T1110","status":"new"},
{"id":"ALR-003","severity":"medium","title":"Proxy block: phishing URL","user":"bob","src_ip":"10.0.2.22","url":"http://phish-lab.fake/login","mitre":"T1566","status":"new"},
{"id":"ALR-004","severity":"low","title":"Scheduled task created","user":"alice","host":"WIN-LAB02","mitre":"T1053","status":"new"}
]
EOFCommand — copy this
jq '.[] | select(.status=="new") | {id, severity, title}' "$SOC_LAB/logs/alerts.json"Primary tools to practice this lesson: jq, python3. Reference sites: Alert triage (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); Elastic alert workflow (https://www.elastic.co/guide/en/security/current/alerts-ui.html); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Reading alert fields
Rule name, severity, source, user, timestamp, MITRE technique tag — SIEM row literacy.
Missing context = enrichment trigger — not automatic true positive.
3. $SOC_LAB boundary
Triage notes from YOUR sample alerts only — not unauthorized prod SIEM queries.
Refused: stranger SIEM access, alert suppression without ticket, attack generation for 'practice.'
4. What you ship: triage process literacy card
Five triage stages + one defender checkpoint each + NEVER unauthorized SIEM line.
5. What you record before the next lesson
Triage process literacy card path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Query employer production SIEM without authorization to 'practice triage.'
Right
Triage process literacy card from $SOC_LAB sample alerts. Next: FP vs TP.
Mission: triage process literacy card
1) Name five triage stages. 2) One defender checkpoint per stage. 3) Read one alert field row from lab sample. 4) Write NEVER unauthorized SIEM line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Severity vs priority — literacy difference?”
Knowledge Check
APPLY: Triage literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Querying stranger SIEM without authorization is lab.
True or False
Knowledge Check
APPLY: Alert triage starts with:
Multiple choice