Web › Module 9 › Lesson 2
Alerting That Matters
Alerts need owners, thresholds, and actions — noise is not detection.
Visual · alerting_that_matters
Pager with three real alerts, not a thousand debug pings. then log locally. Router admin STOP. Tune alerts on systems YOU own.
Opening
A log nobody pages on is a diary — A09 also fails when alerts never fire or never stop.
OWASP Top 10:2025 A09 Security Logging and Alerting Failures includes missing alerts for security events, alerts without owners, and alert fatigue that trains humans to ignore pages. Attacker goal: blend into noise or silence. Cyberlium: design a short alert list for an app YOU operate — not spam a company on-call you do not belong to. Practical commands: ; if router login, STOP. Curl DEMO only if it is YOUR lab app, append a local log, and map which events would page. Next: privacy vs useful logs. Today: alerting that matters.
1. Signal: map must-log events to alertable conditions
Not every log line is an alert. Candidates: burst of auth failures per account/IP, admin role grants, integrity verify failures, repeated authz denies on the same object, sudden spike in 5xx on auth routes. Write threshold sketch and window. Empty “alert on everything” fails.
Severity labels (info/warn/crit) need definitions your team shares on systems you own.
2. Owners and runbooks: who wakes up and what they do
Each alert names an owner rotation and a first five actions (check dashboard, revoke sessions, freeze deploy — whatever fits YOUR app). Alerts without runbooks become ignored noise. Do not page strangers’ phones as a “lab.”
Test alerts in a planned window on infrastructure you control. Document the test — no surprise pages to production customers you do not own.
3. Fatigue: tune, suppress with care, never silence forever
Chronic false positives train ignore. Fix the condition or raise thresholds with review. Temporary suppressions need expiry. “Disable alerting to ship” is an A09 finding waiting to happen.
Correlate with change tickets so known deploys do not look like incidents — on your process.
4. Coverage gaps: if it is must-log, ask how a human learns
For each must-log event from Lesson 1, mark: dashboard only, ticket, or page. Gaps where critical events are logs-only with no review SLA are design debt. Cite A09. Original Cyberlium — not official OWASP certification.
chmod 600 notes. No foreign paging. No hydra on the router.
5. Wrong vs right: page the internet vs owned runbooks
Same word “alert,” opposite ethics.
Wrong
Spam on-call you do not own. Alert on every debug line. Disable all alerts permanently. Hydra 192.168.0.1 to generate “signal.” nmap the LAN.
Right
Identify DEMO; router → STOP. Short alert list with thresholds, owners, runbooks on YOUR stack; lock alerting-notes.txt. Next: Privacy vs Useful Logs.
6. Hands-on: local log + alerting-notes.txt
Identify DEMO. Append a local log line. Write three alerts max for your scope — quality over quantity.
Mission: alerting-notes.txt (mode 600)
1) Optionally curl DEMO and append a local log line.2) Define up to three security alerts with threshold, owner, and first actions. Write a fatigue/suppression policy with expiry. 3) chmod 600 $HOME/cyberlium-lab/alerting-notes.txt. Do not page strangers. No hydra. No nmap.
Stuck? Ask Cyberlium AI Mentor
If alerting still means “email on every log,” ask for a hint. Try: "Hint only: how to pick three high-signal alerts; why owners and runbooks matter; why 192.168.0.1 router login is OUT OF SCOPE; where notes live?"
Detection needs human-closed loops you own. A09. Original Cyberlium — not official OWASP certification. Next — Privacy vs Useful Logs.
Knowledge Check
APPLY: Security logs exist but nobody is paged on admin role grants. Risk?
Multiple choice
Knowledge Check
APPLY: True or False: Permanent alert disable is acceptable to reduce noise.
True or False
Knowledge Check
APPLY: curl of http://192.168.0.1/ is router admin. Page yourself by hydra-ing it?
Multiple choice