Working the alert queue
Your sensors fired overnight. Work the queue: count the Suricata alerts, attribute the port-scan alert to a source, and read the Zeek conn.log to confirm the scan.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`jq -s 'length'` counts the JSON objects.
`select(.alert.signature|test("SCAN"))` filters to the scan alert; conn_state S0 = no reply.
Solution explanation
The sensors tied the case together: three Suricata alerts (a port scan, a suspicious C2 DNS lookup and a web-shell hit), the scan attributed to 203.0.113.66, and a row of S0 connections in Zeek confirming it. jq for JSON alert feeds and reading connection states are core blue-team reflexes.
You have now investigated the same intrusion from five angles. Tying them into one timeline — and deciding what to do about it — is what the rest of this course covers, starting with alert triage in the next module.
Show solution
cd /home/student
jq -s 'length' /srv/soc-data/nids/eve.json
jq -c 'select(.alert.signature|test("SCAN")) | {src_ip, sig: .alert.signature}' /srv/soc-data/nids/eve.json
cat /srv/soc-data/nids/conn.log