Triage sprint
A noisy day in one page: decide quickly what to close, look at, or escalate.
A noisy shift: 11 alerts landed at once. You have no time for a full investigation, so make a call on each.
- lowAntivirus
eicar.com.txt quarantined on lab-pc-04. The user is the security trainer running a scheduled awareness demo.
- mediumIdentity
j.mehta had 3 failed sign-ins, then a success 2 minutes later from the same office address.
- highIdentity
Impossible travel for p.nair: Mumbai, then Frankfurt 4 minutes later. The Frankfurt address is the company VPN exit.
- highEndpoint
Service account svc-backup signed in interactively on a laptop at 01:12. Service accounts normally never do this.
- criticalDirectory
helpdesk-tmp added a new user to Domain Admins at 03:05. There is no change ticket.
- mediumWAF
4 requests with SQL characters to /search from 198.51.100.77. All were blocked with a 403.
- criticalMail gateway
14 users received the same email linking to harborpine-verify.test. 3 of them clicked.
- lowEndpoint
GoogleUpdate.exe made an outbound connection on a standard laptop. File is signed by the vendor.
- highFirewall
ws-fin-07 sent 40 MB to an unknown file-sharing site at 23:50. The user is on leave this week.
- mediumNetwork
10.20.9.5 touched 200 hosts between 22:00 and 22:30. This is the weekly approved scan under CHG-2231.
- mediumVPN
d.rossi connected from Portugal for the first time. Their calendar shows they are on holiday.
Found something confusing or unrealistic?