Chapter 25 — Laboratory I | Bachelor's Security operations and blue team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 The lab"]
  N2["25.2 Prioritisation"]
  N3["Lab — ordering a queue"]
  N4["25.3 Reading the result"]
  N5["25.4 Triage notes"]
  N6["25.5 Errors"]
  N7["25.6 Reflection"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 The lab"]
  N2["25.2 Prioritisation"]
  N3["Lab — ordering a queue"]
  N4["25.3 Reading the result"]
  N5["25.4 Triage notes"]
  N6["25.5 Errors"]
  N7["25.6 Reflection"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 The lab]
    |
    v
[25.2 Prioritisation]
    |
    v
[Lab — ordering a queue]
    |
    v
[25.3 Reading the result]
    |
    v
[25.4 Triage notes]
    |
    v
[25.5 Errors]
    |
    v
[25.6 Reflection]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) practise triage in a contained lab with synthetic alerts; (2) prioritise a queue by severity and asset criticality; (3) document triage decisions; (4) reflect on prioritisation errors.

25.1 The lab

The SOC's training lab contains a copy of the case system loaded with synthetic alerts. No real student or staff data is present.

Using synthetic alerts lets students practise mistakes safely. A student who closes a real compromise as benign could leave an attacker in an account; in the lab, the same mistake becomes a lesson in the debrief. The lab copy also lets Dr. Kim design alerts that teach specific points, such as ties in the score. No alert in the lab names a real person.

25.2 Prioritisation

Not all alerts are equal. A simple score multiplies alert severity (1–3) by asset criticality (1–3); ties are broken by age so older alerts are not forgotten.

Multiplying rather than adding means a high-severity alert on a low-value asset scores the same as a low-severity alert on a critical one, which reflects that both factors matter. Breaking ties by age keeps an alert from waiting indefinitely behind newer ones with the same score, which a queue sorted by score alone would allow.

Lab — ordering a queue

"""Order a triage queue by severity x asset criticality, then age (synthetic alerts)."""
alerts = [("A1","spray detected","medium","idp",3,25), ("A2","mail rule to external","high","mailbox",2,10),
          ("A3","new admin on lab server","high","research-gpu",3,4), ("A4","AV quarantine","low","student-laptop",1,40),
          ("A5","impossible travel","medium","mailbox",2,15)]
sev = {"low":1,"medium":2,"high":3}
for a in sorted(alerts, key=lambda a: (-(sev[a[2]] * a[4]), -a[5])):
    print(f"{a[0]} score={sev[a[2]]*a[4]} age={a[5]:2}m {a[1]} ({a[3]})")

Run with python3 lab_queue_order.py. Verified output:

A3 score=9 age= 4m new admin on lab server (research-gpu)
A1 score=6 age=25m spray detected (idp)
A2 score=6 age=10m mail rule to external (mailbox)
A5 score=4 age=15m impossible travel (mailbox)
A4 score=1 age=40m AV quarantine (student-laptop)

25.3 Reading the result

A3 (new administrator on the research GPU server, high severity on a critical asset) scores 9 and comes first. A1 (spray against the identity provider) and A2 (external mail rule) both score 6; A1 is older so comes first. A5 scores 4 and A4, an antivirus quarantine on a student laptop, scores 1.

A3 deserves first place: a new administrator on the GPU server could mean an attacker securing access, as in the week-five case. A4 comes last despite being the oldest, because antivirus already quarantined the file and the laptop is personal. The ordering matches what an experienced analyst would choose most of the time.

25.4 Triage notes

For each alert, the lab sheet records the decision (benign, suspicious, malicious), evidence checked and next action.

A note for A1 might read: decision suspicious; evidence checked, thirty accounts each targeted once from one external address, no later successful sign-ins; next action, block the source address and close. Recording evidence checked lets a reviewer see that the decision was based on the right questions, not only on the outcome. Notes are written before the next alert is opened, while details are fresh. In the debrief, Dr. Kim compares notes across students to see whether they checked the same evidence.

25.5 Errors

In the first run, Lucas spends ten minutes on A4 because it is oldest, delaying A3. Ordering by score first prevents this.

Lucas's mistake was natural, since the oldest item in a queue feels most urgent. In a real shift, ten minutes on a harmless quarantine while a server gained an unexpected administrator could let an intruder settle in. The debrief turned the mistake into a rule in the triage guide: read the score first. Lucas added a line to his own checklist as well.

25.6 Reflection

Scores support but do not replace judgement: an analyst who knows the mail rule matches the s2047 pattern may escalate A2 ahead of A1.

In the lab, A2's pattern matched s2047 exactly: an external forwarding rule six minutes after a sign-in from a new country. Escalating it ahead of the equally scored spray was justified because the spray had produced no successful sign-ins, while A2 indicated an account already in an attacker's hands. Dr. Kim's comment on his sheet confirms this reasoning, and the triage guide now notes that pattern matches can override equal scores.

Lab debrief

After each lab session, student analysts compare their decisions in a short debrief. Disagreements are discussed with evidence, not settled by seniority. Recurring confusion becomes a new note in the triage guide, so the next cohort benefits.

Worked example

Lucas's lab sheet for A2: "Rule forwards to external address; created 6 minutes after a sign-in from a new country; same pattern as s2047. Decision: malicious (likely). Action: escalate to service desk for reset; disable rule after export." Dr. Kim notes that this judgement correctly overrode the score order.

Synthetic case. Alerts come from the lab script.

Errors and limits

Simple scores ignore context such as campaign patterns; analysts must think beyond them.

Exercises

EX073 — Score formula. How is the triage score calculated, and how are ties broken?
Show marking criteria
Rubric: 3 = severity × criticality; age breaks ties; 2 = partial; 1 = vague; 0 = none.
EX074 — Queue order. Give the queue order from the lab.
Show marking criteria
Rubric: 3 = A3, A1, A2, A5, A4; 2 = most; 1 = wrong; 0 = none.
EX075 — Overriding the score. Why did Lucas escalate A2 ahead of A1?
Show marking criteria
Rubric: 3 = matched known s2047 compromise pattern; 2 = partial; 1 = score; 0 = none.

Synthesis

Scored queues keep triage orderly; documented judgement handles what the score cannot see.

Continue studying — chapter 25 of 40

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →