From alert to verdict

Every alert gets the same questions

In the first six modules you read each log. Triage is the discipline that sits on top: a repeatable workflow you run on every alert so nothing is judged on a hunch.

1. Validate — is the alert real, or a sensor artefact?
2. Enrich — pivot the indicators (IP, user, host) into other evidence.
3. Scope — what else did this actor touch?
4. Decide — true positive or false positive?
5. Severity & escalate — how bad, and who needs to know?

Start by pulling the alerts the sensor raised:

jq -c '{src_ip, signature: .alert.signature, severity: .alert.severity}' /srv/soc-data/nids/eve.json

In the terminal

student@vulntech:~$ jq -c '{src_ip, signature: .alert.signature, severity: .alert.severity}' /srv/soc-data/nids/eve.json
{"src_ip":"203.0.113.66","signature":"ET SCAN Potential TCP Port Scan","severity":2}
{"src_ip":"10.10.10.5","signature":"ET DNS Query to a suspicious .net C2 domain","severity":1}
{"src_ip":"203.0.113.66","signature":"ET WEB_SERVER PHP webshell access","severity":1}

Tip: Enrichment is just pivoting: take the alert's source IP and go looking for it everywhere else. An IP that only appears in one scan alert is noise; one that also has a successful login is an incident.