Work the top alert
Your queue has the overnight Suricata alerts. Work the top one through the triage workflow: size up the queue, pivot the indicator into the auth log to confirm impact, and record a verdict.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`jq -s 'length'` counts the alert objects.
Pivot the alert's source IP into auth.log and look for `Accepted password`.
Solution explanation
That is the whole workflow in miniature: three alerts in the queue, one indicator (203.0.113.66) pivoted into the auth log, one confirmed successful login, and a verdict of true positive / high severity written down. The decision came from evidence, not instinct — which is the entire point of a triage process.
Show solution
cd /home/student
jq -s 'length' /srv/soc-data/nids/eve.json
grep -c 'Accepted password.*203.0.113.66' /srv/soc-data/linux/auth.log
echo 'TRUE POSITIVE - attacker 203.0.113.66 scanned then logged in as svc-backup' > /home/student/triage.txt