SOC L1 Alert Triage

Prompts and answers

• What is the number of alerts you see in the SOC dashboard?
  5
• What is the name of the most recent alert you see?
  Double-Extension File Creation
• What was the verdict for the "Unusual VPN Login Location" alert?
  False Positive
• What user was mentioned in the "Unusual VPN Login Location" alert?
  M.Clark
• Should you first prioritise medium over low severity alerts? (Yea/Nay)
  Yea
• Should you first take the newest alerts and then the older ones? (Yea/Nay)
  Nay
• Assign yourself to the first-priority alert and change its status to In Progress.
  The name of your selected alert will be the answer to the question.
• Potential Data Exfiltration
  Which flag did you receive after you correctly triaged the first-priority alert?
• THM{looks_like_lots_of_zoom_meetings}
  Which flag did you receive after you correctly triaged the second-priority alert?
• THM{how_could_this_user_fall_for_it?}
  Which flag did you receive after you correctly triaged the third-priority alert?
• THM{should_we_allow_github_for_devs?}
  No answer provided