SOC Triage: The Alert That Didn't Fire
The scariest alert in a SOC is the one that never fires. This lab gives you a live SIEM fed by real host and network telemetry, with an attacker generating genuine beaconing traffic, so you learn to trust the raw data over the dashboard and find why a detection stayed silent.
The problem
A host was compromised and is beaconing out, but the SIEM never raised an alert, even though a rule exists that should have matched. The raw telemetry is in the index; the detection just never triggered.
What you'll practice
- Triage a suspected incident from raw SIEM telemetry
- Read a detection rule and the fields it depends on
- Correlate a log source's parsed fields against a rule's conditions
- Fix a detection that ingests data but never evaluates it
- Re-test against historical events and tune for false positives
The topology
A SOC pod runs a SIEM fed by host and network telemetry, with an attacker host generating real beaconing traffic, so detections are validated against genuine events rather than sample data.
Topology diagram
Frequently asked
If the data is there, why no alert?
A rule can match on a field that a given log source never populates, so the events are indexed but never evaluated. The data is present; the rule is looking in the wrong place.
Is this CyberOps Associate level?
Yes. Triage, detection logic and telemetry correlation are core CyberOps Associate (200-201 CBROPS) skills, and this lab drills them on real data.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.