SOC Triage: The Alert That Didn't Fire
The evidence is indexed and the detection is enabled, and still nothing fired. Compare the rule's fields against the documents, live, right below.
Symptom
A host is beaconing out and the telemetry is in the SIEM, but the detection rule that should have caught it never triggered.
Your mission
Inspect, recover, then verify
Format
Linux shell
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: Linux
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
A host was compromised and is beaconing out, but the SIEM never raised an alert, even though a rule exists that should have matched. The raw telemetry is in the index; the detection just never triggered.
What you'll practice
- Triage a suspected incident from raw SIEM telemetry
- Read a detection rule and the fields it depends on
- Correlate a log source's parsed fields against a rule's conditions
- Fix a detection that ingests data but never evaluates it
- Re-test against historical events and tune for false positives
The topology
A SOC lab runs a SIEM fed by host and network telemetry, with an attacker host generating real beaconing traffic, so detections are validated against genuine events rather than sample data.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
wc -l events.jsonjq -c 'select(.event_type=="authentication_failure" and .src_ip=="198.51.100.77")' events.jsonjq -r 'keys_unsorted | join(", ")' events.jsonTopology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
If the data is there, why no alert?
A rule can match on a field that a given log source never populates, so the events are indexed but never evaluated. The data is present; the rule is looking in the wrong place.
Is this CyberOps Associate level?
Yes. Triage, detection logic and telemetry correlation are core CyberOps Associate (200-201 CBROPS) skills, and this lab drills them on real data.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.