SIEM Alert Triage Game — TechKnowSurge

About this interactive

Every monitoring module teaches what a SIEM does — it collects logs from everywhere, correlates them, and raises an alert when a rule matches. What almost no module teaches is the job that actually exists on the other side of that alert, which is deciding what the alert is worth before anything else can happen to it. That decision is where security operations either works or drowns. An analyst who escalates everything burns the on-call engineer out in a week and gets ignored. An analyst who closes everything that looks routine will close the one that was not. Both failures come from the same habit: grading the rule name instead of reading the context underneath it. This set is thirty SIEM alerts, each presented with the context cards a real analyst would have open beside it — what the host is for, whose account it is and what privilege it holds, the time of day, whether a change record covers it, and what ninety days of baseline says is normal for that host and that user. Three verdicts, and a rubric stated up front so the answer is defensible rather than a matter of taste. True positive means the rule fired on exactly the activity it names and the evidence in hand already establishes that the activity is unauthorized. False positive means the alert does not survive its own context — the rule matched something it was never built to match, or the activity has a documented, verified benign cause. Needs investigation means the activity is real and unexplained and the evidence genuinely does not settle it, so the correct move is collecting the one fact that would. That third bucket is the one students find hardest and the one that matters most, because the discipline being taught is refusing to promote an alert the evidence does not support and refusing to close one just because it looks familiar. The pool is built in deliberate pairs so the rule name can never produce the verdict. A failed-logon burst is a true positive when one external address tries a single password against 480 accounts, staying under the lockout threshold, and three of them work; it is a false positive when sixty failures come from one host in four minutes beginning at the exact second an approved service-account password rotation started, and stop when the stored credential updates. A port scan is a false positive from the inventoried vulnerability scanner in its approved monthly window, needs investigation from a developer's laptop scanning the developer subnet at two in the afternoon, and a true positive when a finance workstation maps 254 addresses of the server VLAN at 03:12 with the user logged out and the scanning process running from a roaming profile. Impossible travel is a false positive when both addresses are corporate VPN egress carrying the same device identifier and the same session token, and a true positive when the second session registers a new multi-factor method and an external mail forwarding rule filtered on the word invoice within four minutes. Large egress is a false positive from the backup server to the contracted provider on its two-year schedule, needs investigation from a marketing workstation to a nine-year-old commercial transfer service that no policy covers, and a true positive from an employee in their notice period who bulk-read 3,100 finance files twenty minutes before uploading 14 GB to personal cloud storage overnight. Facing the student with the same rule name twice and a different answer each time is the entire design, because it makes a wrong answer diagnosable: whoever gets one of a pair wrong skipped a specific clue, and the clue has a name. The false positives are chosen to be the ones that recur in every real environment rather than invented ones — an untuned vendor rule matching the English word select in a search box, a DLP rule matching the card brands' own published test numbers in a test fixture, a failed NTP client whose seven-hour clock drift turns business-hour logons into an out-of-hours alert, a software-distribution agent writing autorun keys on 300 hosts under an approved change. Each of those closes with a tuning action rather than just a close, because an untuned rule charges the same hour to every analyst who comes after. Addresses standing in for external hosts come from the RFC 5737 documentation ranges, which cannot route; internal addressing is RFC 1918; no real card number, hash or domain is asserted anywhere. Ten alerts resolve each way and the correct answer sits in each of the three positions exactly ten times, so a student who always picks the first option scores 33 percent and learns nothing, which is the point. Run it after the module lessons on logging, alerting and baselines, and again after the wrap: twelve drawn from thirty means two consecutive rounds overlap without repeating, and the alerts that fooled you the first time come back.

What you'll learn

Assign a triage verdict of true positive, false positive or needs investigation to a SIEM alert, and justify it from the alert's context rather than from the name of the rule that fired
Read the context an alert arrives with — hostname and its role, the account and its privilege, the time of day, the change record, and what ninety days of baseline says is normal for both host and user — and identify which single fact decides the verdict
Distinguish activity that the evidence already proves unauthorized from activity that is merely unexplained, by testing whether a benign reading exists that accounts for every fact in front of you
Recognise the recurring sources of false positives in a monitoring pipeline — untuned vendor default rules, authorised scanners and backup jobs, service-account password rotations, VPN egress breaking geolocation, and clock drift breaking timestamps — and explain why closing them without tuning the rule leaves the next analyst the same work
Explain why an alert that cannot be resolved without a phone call is usually evidence of a missing baseline, policy or log source rather than evidence of an attack, and name the collection step that would settle it

Aligned to

CompTIA Security+

4.4 Explain security alerting and monitoring concepts and tools.

4.9 Given a scenario, use data sources to support an investigation

2.4 Given a scenario, analyze indicators of malicious activity.

NIST CSF

RS.MA-03 Incidents are categorized and prioritized.

DE.AE-03 Information is correlated from multiple sources.

CompTIA CySA+

1.2 Given a scenario, analyze indicators of potentially malicious activity.

1.3 Given a scenario, use appropriate tools or techniques to determine malicious activity.

ISC2 CISSP

7.2 Conduct logging and monitoring activities

NIST 800-53

SI-4 System Monitoring

NIST NICE

K1269 Knowledge of security information and event management (SIEM) tools and techniques

Key terms

Security Information and Event Management: A system that aggregates and analyzes security event data from across an organization to detect and respond to threats.
Incident Triage: The initial assessment of a declared incident to determine its scope, affected systems, required personnel, and the approach for troubleshooting and resolution.
False Positive: An alert that fires when no actual issue exists, which over time can cause administrators to ignore notifications and reduce monitoring effectiveness.
True Positive: A scan result that correctly identifies a vulnerability that actually exists on the system.
Alerting: The automated notification process that triggers when monitored systems deviate from expected thresholds, informing administrators of potential issues.
Baseline: A documented set of minimum security standards or performance metrics used as a reference point.
Anomaly: An observable deviation from expected behavior in a system or network that may indicate a performance issue or security threat.
Risk Prioritization: The process of ranking identified risks by their potential impact and likelihood to determine which require the most urgent attention.
Escalation: The process of elevating a security issue — such as a critical vulnerability or active incident — to a higher priority or authority level when the standard response process is insufficient or too slow to address the threat.
Logging: A monitoring method that records system or network events as they occur, creating an auditable history of activity.
Log Aggregation: The process of collecting and centralizing log data from multiple systems and devices into a single location for unified analysis and monitoring.
Password Spraying: An attack that attempts a single commonly used password against many different user accounts before moving to the next password, deliberately staying below account lockout thresholds to avoid detection.
Credential Stuffing: An automated attack in which stolen username and password pairs from one breached service are systematically tested against other services to gain unauthorized access. It exploits users who reuse passwords across multiple accounts.
Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Account Lockout: A security control that disables a user account after a defined number of failed login attempts to prevent unauthorized access.
Impossible Travel: A security alert triggered when account logins occur from geographically distant locations within a timeframe that makes physical travel impossible, indicating potential unauthorized access.
Port Scanning: A technique used to discover open ports and services available on a networked device.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.
Lateral Movement: A MITRE ATT&CK tactic in which an adversary pivots from one compromised system to other systems within the same network environment.
Privilege Escalation: An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
Persistence: A MITRE ATT&CK tactic in which an adversary maintains their foothold within a compromised network to survive restarts, credential changes, or other interruptions.
User and Entity Behavior Analytics: User and Entity Behavior Analytics uses machine learning to establish behavioral baselines for users, devices, and applications, then alerts on deviations that may indicate insider threats, compromised accounts, or lateral movement.
Change Management: A structured process for requesting, reviewing, approving, and documenting changes to IT systems or organizational procedures. Change management reduces security risk by ensuring modifications are tested and authorized before deployment.
Security Operations Center: A centralized team and facility responsible for monitoring, detecting, and responding to security incidents.
Endpoint Detection and Response: A security solution that continuously monitors endpoint devices to detect, investigate, and respond to threats.
Intrusion Detection System: A system that monitors network or system activities for malicious behavior and generates alerts.
Signature-based Detection: A detection method that identifies threats by comparing network traffic or system activity against a database of known attack patterns and fingerprints.
Data Loss Prevention: A set of tools and processes designed to detect and prevent unauthorized access, use, or transmission of sensitive data.
NetFlow: NetFlow is a Cisco network protocol that collects IP traffic flow metadata including source, destination, protocol, and byte counts, widely used in security operations for traffic analysis, anomaly detection, and incident investigation.
Network Traffic Analysis: The process of inspecting and analyzing data flowing across a network to identify anomalies, unauthorized transfers, or potential data loss events.
Threat Intelligence: Information about existing or emerging threats that helps organizations make informed security decisions.
Indicators of Compromise: Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
Beaconing: A pattern of regular, repeated outbound network communications from a compromised host to an attacker's command-and-control server.
Runbook: A detailed, step-by-step set of instructions used to guide responders through a specific incident response task or scenario.
Least Privilege: A security principle that grants users and systems only the minimum access rights needed to perform their functions.
Multi-Factor Authentication: An authentication method that requires users to provide two or more verification factors to gain access.

Topics

Interactive Quiz Game

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →