OpenCyber AcademyLesson map
Lesson 15. Map, example, EX061.
flowchart TD
T["Staff tell Leo before travel"] --> L["BrightPath keeps a trip list"]
L --> C["The abroad alert is checked faster"]
F["Forwarding alerts"] --> U["Unchanged"]
M["MFA alerts"] --> U
C --> Q{"Does the list delete the signal?"}
Q -->|No| K["The four signals stay"]
The list shortens a check. It does not remove a detector.
Logical drawing
signal kept: unusual-country or night sign-ins
aid added: a trip list in prose
signals left unchanged: forwarding rules, MFA changes
not a filter inside lab_signins.py
Learning outcomes
After this chapter, you should be able to:
- Say what the travel list changes about the check.
- Name the alerts that stay as they are.
- Refuse a deleted signal or a rewritten script.
15.1 The list is a lookup for humans. The four signals stay four.
Staff tell Leo before they travel. BrightPath adds the trip to a list so an abroad sign-in can be checked against a known journey. In the first month, a Spain sign-in during a colleague's known holiday could be checked in a minute. The check is shorter. The alert still exists. The list does not delete the unusual-country signal, and it does not change the night cut inside the script. lab_signins.py has no trip list, no Spain row, and no holiday field.
Forwarding-rule alerts stay unchanged because they are rare and each one needs a look. MFA-change alerts stay unchanged for the same reason. Two new phones were innocent, and the next MFA change might not be. The staff reports of odd emails, the fourth signal from chapter 1, are not replaced by the trip list either.
Hassan and colleagues (2019) describe automated triage of alert fatigue with provenance. Leo's question is still the human one from chapter 4: is there an innocent explanation we can confirm? The trip list feeds that question. It is not a provenance graph, and this book does not deploy one. Kokulu and colleagues (2019) studied how security operations centres match or miss their tasks. A trip list is not a maturity score for BrightPath.
Lesson table; scroll horizontally to read all columns →
| Item | Effect of the travel list |
|---|---|
| Abroad sign-in alert | Still raised, checked faster |
| Night test in the script | Unchanged |
| Forwarding alert | Unchanged |
| MFA alert | Unchanged |
signins list |
Unchanged |
15.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Offered change | What it would do | Decision |
|---|---|---|
| A trip list beside the weekly summary | Shorter human check | Keep, as prose |
| Forwarding and MFA alerts left on | They stay rare and necessary | Keep |
| "Remove abroad alerts during holidays." | Deletes the signal | Refuse |
| "Add Spain to the lab list." | A different script | Refuse |
Synthetic case. The holiday and the roaming phone stay unnamed people.
Errors and limits
Do not edit the sign-in script so a trip becomes a column.
Apply
- EX061 — What the list changes. What does the travel list shorten, and which alerts stay unchanged?
Show marking criteria
Rubric: 3 = it shortens the check of an abroad sign-in; it does not delete that signal; forwarding and MFA alerts stay; the script is not edited;; 2 = the check is shorter and the other alerts stay;; 1 = one alert;; 0 = none.