Chapter 11 — Security operations and blue team: assets and context
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Why context"]
N2["11.2 Inventories"]
N3["11.3 Criticality"]
N4["11.4 Business hours"]
N5["11.5 Keeping current"]
N6["11.6 Contacts"]
N7["11.7 Case"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Why context"]
N2["11.2 Inventories"]
N3["11.3 Criticality"]
N4["11.4 Business hours"]
N5["11.5 Keeping current"]
N6["11.6 Contacts"]
N7["11.7 Case"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Why context]
|
v
[11.2 Inventories]
|
v
[11.3 Criticality]
|
v
[11.4 Business hours]
|
v
[11.5 Keeping current]
|
v
[11.6 Contacts]
|
v
[11.7 Case]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) build and maintain client asset inventories; (2) assign criticality and owners; (3) use context to prioritise alerts; (4) keep context current across many clients.
11.1 Why context
An alert on a host means little without knowing what the host does, who owns it and how important it is. Context turns "new admin on CLINIC2-SRV" into "new admin on the server holding patient records at a clinic that is closed tonight".
The extra words in that enriched line change what the analyst decides. A new administrator on a test machine during working hours might wait for the morning queue, whereas the same event on the patient-records server of a closed clinic justifies waking Raj. Mei's role sheet from chapter 1 is what provides those words; without it the alert would read only as a host name and an event ID.
11.2 Inventories
For each client, Copperleaf records hosts, roles, operating systems, criticality (low, medium, high), business hours and contacts. Agents report hosts automatically; roles and criticality come from the client.
The split matters because the agent can see that CLINIC2-SRV exists and runs Windows, but cannot know that it holds patient records or that the clinic closes in the evening. Those facts come from the office manager and the contractor. Mei's inventory for clinic 2 combines both kinds: agent-reported hosts plus the roles and hours the client confirmed.
11.3 Criticality
Servers with patient or financial data are high; reception PCs medium; guest devices low. Criticality multiplies alert severity in queue ordering.
In practice, the same rule produces different priorities by host. A new local administrator on CLINIC2-SRV, rated high, lands at the top of the queue, while the same event on a guest device would sit lower. Mei checks this ordering on the queue view, because a wrong criticality rating would push a serious alert below routine ones. Mei applies the ratings the client gave, but questions them when an alert reveals a host doing more than its rating suggests.
11.4 Business hours
Clinic hours make night-time activity on clinic systems more suspicious; a law firm with late workers has different hours.
BrightSmile's clinics close in the evening, and Mei's out-of-hours rule uses a window from 06:45 to 19:00 local time for the reception account. A law firm client with staff working late would need a different window, so the hours are stored per client rather than written into the rule. The 01:19 reception logon on the incident night fell well outside BrightSmile's hours. Stored hours also feed the enrichment line on alerts, which is how "clinic closed" appeared beside the support2 alert on the incident night.
11.5 Keeping current
Inventories decay as clients add devices. A monthly report lists new hosts seen by agents but missing roles, and Copperleaf asks the client to classify them.
The worked example shows why the report matters: in one month clinic 1 gained a new card terminal and a dentist's personal laptop, neither of which anyone had mentioned. Without the report, an alert from the laptop would have arrived with no role and no owner, and the analyst would have spent the first minutes finding out what it was.
11.6 Contacts
Every client has a primary and backup contact with phone numbers for night calls; at BrightSmile these are the office manager and the IT contractor.
On the incident night these contacts were used in order. The office manager was called at 01:40 and agreed to keep the clinic closed, and the IT contractor was the person who would later change the firewall and restore the server. Mei checks the numbers during onboarding, because a wrong number discovered at night costs time that cannot be recovered.
11.7 Case
When the support2 alert fired, enrichment showed "CLINIC2-SRV — high — patient records — clinic closed".
Each part of that line came from a different place. The host name came from the agent, the high criticality and patient-records role from the client inventory, and "clinic closed" from the stored business hours compared with the alert time. Mei did not need to look anything up before deciding that the alert was urgent. That one enriched line is also what Raj read when Mei phoned him, so the decision to isolate the server rested on facts already in front of both of them.
Context in reports
Client reports name assets by role rather than host name: 'your clinic 2 server' means more to an office manager than CLINIC2-SRV.
Worked example
The monthly report for BrightSmile shows two unknown hosts at clinic 1. The office manager identifies one as a new card terminal and the other as a dentist's personal laptop joined to the clinic Wi-Fi. Mei records the terminal and recommends moving personal devices to guest Wi-Fi.
Synthetic case. Inventories and hosts are invented.
Errors and limits
Client-provided criticality can be wrong; question it when alerts reveal surprises.
Exercises
- EX031 — Context value. How did context change the meaning of the support2 alert? Rubric: 3 = patient-records server at closed clinic: urgent; 2 = partial; 1 = vague; 0 = none.
- EX032 — Inventory fields. List four fields in a client asset inventory. Rubric: 3 = hosts, roles, OS, criticality, hours, contacts (four); 2 = three; 1 = one; 0 = none.
- EX033 — Unknown hosts. What were the two unknown hosts, and what was done? Rubric: 3 = card terminal recorded; personal laptop → guest Wi-Fi advised; 2 = partial; 1 = vague; 0 = none.
Synthesis
Asset context drives prioritisation; keep it current with automatic discovery and client confirmation.
Continue studying — chapter 11 of 30
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →