SOC alert triage & SIEM investigation
Triage alerts, pivot through logs and write an incident timeline in SIEM consoles.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- Splunk · Elastic Security · Sentinel
- Class GUI-need label
G2· GUI-essential
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R03.05.01.03-T01 Triage an SSH brute-force alert in Splunk
Original instruction
In the lab Splunk instance (index=auth seeded with synthetic logs), open alert AL-1007 'Multiple failed logins'. Determine the attacking source IP and the count of failures, confirm whether any succeeded, and record the finding in the notable event's comment plus an incident timeline note.
- Platforms
web· Any OS (web)- Applications
- Splunk
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & formsvis· Visual judgment- Work product
WP01· Document- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Notable AL-1007 has a comment stating the correct source IP and failure count (match lab ground truth) and the right TP/FP disposition; a timeline note records the success/no-success verdict. Graded on the console's saved notable/comment state, not a raw REST dump. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.
Proposed partial credit
40% correct source IP; 30% failure count + success verdict; 30% disposition recorded in the notable
R03.05.01.03-T02 Build a failed-login dashboard panel in Splunk
Original instruction
Create a Splunk dashboard 'Auth Monitor' with a panel showing failed logins per hour for the last 24h (synthetic index=auth) and a second panel listing the top 10 source IPs by failures. Save the dashboard and set the time range picker to default to 24h.
- Platforms
web· Any OS (web)- Applications
- Splunk
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & formsvis· Visual judgment- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Dashboard 'Auth Monitor' exists with the two panels whose searches aggregate failed logins correctly (values match the seeded data); default time range is 24h. Graded on saved dashboard XML/state in the console. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.
Proposed partial credit
40% per-hour timechart panel; 40% top-10 source IP panel; 20% saved with 24h default
R03.05.01.03-T03 Tune a noisy Elastic detection rule
Original instruction
In the lab Elastic Security (Kibana), rule 'Unusual Process' fires on a benign backup job. Without disabling the rule, add a tuning exception so the backup process (given in notes) no longer alerts while real anomalies still do. Document the exception rationale.
- Platforms
web· Any OS (web)- Applications
- Elastic Security
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Rule has an exception matching the backup process only; re-running the rule over the seeded data suppresses the benign alerts and keeps the 2 true anomalies; exception note present. Graded on the rule's saved exception list and alert outcomes in the app. No Kibana or Elasticsearch API key is issued and port 9200 is firewalled; the Kibana audit log must tie each change to a browser session id.
Proposed partial credit
40% scoped exception added; 40% benign suppressed + true alerts kept; 20% rationale documented
R03.05.01.03-T04 Trace lateral movement across sources in Sentinel
Original instruction
In the lab Microsoft Sentinel workspace (synthetic SigninLogs, DeviceLogon, Proxy), incident INC-204 flags a suspicious account. Pivot across the sources to reconstruct the account's path between hosts, add the involved entities to the incident, and write an ordered incident timeline of the lateral movement.
- Platforms
web· Any OS (web)- Applications
- Sentinel
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & formsvis· Visual judgment- Work product
WP01· Document- Conditions
long· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
Incident INC-204 has the correct account+host+IP entities added and an ordered timeline naming the hop sequence matching lab ground truth; severity set per playbook. Graded on the saved incident entities/comments/timeline in Sentinel. The agent has only an interactive Azure portal login (no service principal, Azure CLI or Graph/ARM token), and Activity Log must show each change came from the portal browser session.
Proposed partial credit
30% correct entities added; 40% hop sequence correct+ordered; 30% severity+timeline recorded
R03.05.01.03-T05 Disposition a batch of 10 alerts
Original instruction
Ten open alerts are queued in the lab SIEM. For each, investigate the seeded evidence and set disposition True Positive or False Positive with a one-line justification, then assign the TPs to the 'IR' queue. Leave no alert in the New state.
- Platforms
web· Any OS (web)- Applications
- Splunk · Elastic Security
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & forms- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
All 10 alerts have a disposition matching the lab answer key (>=8/10 to pass), each with a non-empty justification; TPs are assigned to IR. Graded on saved alert status/owner fields. No Splunk REST token or Kibana/Elasticsearch API key is issued and ports 8089/9200 are firewalled from the agent VM, so changes can be made only in the browser UIs.
Proposed partial credit
60% dispositions match key; 20% justifications present; 20% TPs routed to IR
R03.05.01.03-T06 Assemble a phishing kill-chain
Original instruction
Alert 'Suspicious attachment' fired in the lab SIEM (synthetic mail, endpoint, proxy logs). Identify the recipient who opened the attachment, the spawned process, and the first outbound connection. Build the kill-chain in the incident with each stage as a timeline entry and set severity High.
- Platforms
web· Any OS (web)- Applications
- Elastic Security
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & formsvis· Visual judgment- Work product
WP01· Document- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Incident timeline lists recipient, process, and first C2 connection matching lab ground truth, in order; severity High. Graded on the saved incident timeline/entities. No Kibana or Elasticsearch API key is issued and port 9200 is firewalled; the Kibana audit log must tie each change to a browser session id.
Proposed partial credit
30% recipient identified; 30% spawned process; 20% first outbound; 20% ordered timeline+severity
R03.05.01.03-T07 Create a Sentinel analytics rule with grouping
Original instruction
In the lab Sentinel, create a scheduled analytics rule from the provided KQL that detects >5 failed MFA challenges in 10 min per user. Map it to the right MITRE tactic, group alerts into one incident per user, and run it once to confirm it generates the expected incidents.
- Platforms
web· Any OS (web)- Applications
- Sentinel
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Rule exists with the KQL, 10-min window, per-user alert grouping, and the correct MITRE mapping; a test run yields exactly the expected number of incidents on the seeded data. Graded on the saved rule config and generated incidents. The agent has only an interactive Azure portal login (no service principal, Azure CLI or Graph/ARM token), and Activity Log must show each change came from the portal browser session.
Proposed partial credit
40% rule with correct logic/window; 30% per-user grouping; 30% MITRE map + expected incidents
R03.05.01.03-T08 Write an SPL exfil search and save as alert
Original instruction
In Splunk, write an SPL search over index=proxy (synthetic) that flags any internal host sending >50 MB outbound to a single external host in 1h. Verify it finds the one seeded exfil host, then save it as a scheduled alert that emails the SOC (lab mailbox).
- Platforms
web· Any OS (web)- Applications
- Splunk
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrolltype· Text & formsclick· Point & click- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
The search returns the one correct host over the seeded data; a saved scheduled alert exists with the threshold and the lab email action. Graded on the saved search/alert definition and result. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.
Proposed partial credit
50% search finds the exfil host; 30% correct threshold/window; 20% saved as scheduled alert
R03.05.01.03-T09 Extract C2 indicators from a beacon pattern
Original instruction
A beaconing alert fired in the lab SIEM. Investigate the periodic connections in index=proxy, identify the C2 domain, IP, and the regular beacon interval, and record all three as indicators on the incident case. Flag the suspected agent process on the host.
- Platforms
web· Any OS (web)- Applications
- Splunk · Elastic Security
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clickvis· Visual judgmenttype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Incident holds the correct C2 domain, IP, and beacon interval (within tolerance) and the correct process name, matching lab ground truth. Graded on saved case indicators/observables. No Splunk REST token or Kibana/Elasticsearch API key is issued and ports 8089/9200 are firewalled from the agent VM, so changes can be made only in the browser UIs.
Proposed partial credit
30% C2 domain; 30% C2 IP; 20% interval; 20% process
R03.05.01.03-T10 Add entities and set severity on an incident
Original instruction
Open incident INC-311 in the lab SIEM. From the linked alert, add the user, host, and source IP as entities, set severity Medium, assign it to analyst 'you', and move it from New to Active. Leave a one-line triage note.
- Platforms
web· Any OS (web)- Applications
- Sentinel
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
INC-311 has the three correct entities, severity Medium, owner set, status Active, and a non-empty note. Graded on saved incident fields. The agent has only an interactive Azure portal login (no service principal, Azure CLI or Graph/ARM token), and Activity Log must show each change came from the portal browser session.
Proposed partial credit
40% three entities added; 30% severity+owner+status; 30% triage note
R03.05.01.03-T11 Timeline a Windows privilege escalation
Original instruction
From the seeded Windows Security events in the lab SIEM, reconstruct how a standard user gained admin: the 4672/4688 events, the tool used, and the new admin group membership. Build an ordered incident timeline and name the escalation technique.
- Platforms
web· Any OS (web)- Applications
- Elastic Security · Splunk
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clickvis· Visual judgmenttype· Text & forms- Work product
WP01· Document- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Timeline lists the triggering process, the privilege-assignment event, and the group change in correct order matching lab ground truth; technique named. Graded on saved incident timeline. No Splunk REST token or Kibana/Elasticsearch API key is issued and ports 8089/9200 are firewalled from the agent VM, so changes can be made only in the browser UIs.
Proposed partial credit
30% key events found; 40% correct ordering; 30% technique named
R03.05.01.03-T12 Suppress a benign alert with an exception
Original instruction
Alert 'PowerShell download' fires daily from a sanctioned admin script in the lab SIEM. Add a precise suppression/exception for that script path and signer only, so future runs are suppressed but other PowerShell downloads still alert. Document why.
- Platforms
web· Any OS (web)- Applications
- Elastic Security
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Exception matches only the sanctioned script path/signer; re-running over seeded data suppresses the benign events and keeps 2 unsanctioned ones; rationale note present. Graded on the saved exception and outcomes. No Kibana or Elasticsearch API key is issued and port 9200 is firewalled; the Kibana audit log must tie each change to a browser session id.
Proposed partial credit
50% scoped exception; 30% benign suppressed + others kept; 20% rationale
R03.05.01.03-T13 Hunt with KQL and pin findings in Sentinel
Original instruction
In the lab Sentinel, run a provided hunting query for rare parent-child process pairs over the synthetic DeviceProcessEvents. Identify the two suspicious pairs, bookmark them, and promote them into a new incident with notes.
- Platforms
web· Any OS (web)- Applications
- Sentinel
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & formsvis· Visual judgment- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
The two correct process pairs are bookmarked and attached to a new incident with notes matching lab ground truth. Graded on saved bookmarks and the created incident. The agent has only an interactive Azure portal login (no service principal, Azure CLI or Graph/ARM token), and Activity Log must show each change came from the portal browser session.
Proposed partial credit
50% both suspicious pairs identified; 30% bookmarked; 20% promoted to incident with notes
R03.05.01.03-T14 Compute attacker dwell time
Original instruction
Using the seeded multi-source logs for incident INC-150 in the lab SIEM, determine the timestamp of first compromise and the timestamp of detection, compute the dwell time in hours, and record all three on the incident.
- Platforms
web· Any OS (web)- Applications
- Splunk
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clickvis· Visual judgmenttype· Text & forms- Work product
WP12· Answer/decision- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Recorded first-compromise and detection timestamps match lab ground truth (within 1 min) and the dwell hours are consistent. Graded on saved incident fields. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.
Proposed partial credit
40% first-compromise time; 40% detection time; 20% dwell computed
R03.05.01.03-T15 Map incident activity to MITRE ATT&CK
Original instruction
For incident INC-150 in the lab SIEM, review the collected evidence and tag each stage with the correct MITRE ATT&CK technique ID (initial access, execution, persistence, exfiltration). Add the technique list to the incident.
- Platforms
web· Any OS (web)- Applications
- Sentinel · Elastic Security
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
The four technique IDs recorded on the incident match the lab answer key (>=3/4 to pass). Graded on saved incident technique tags/comments. No Azure service principal, CLI credential or Kibana/Elasticsearch API key is issued to the agent, so the incident can be edited only in the browser (Sentinel and Kibana UIs).
Proposed partial credit
25% initial-access technique; 25% execution technique; 25% persistence technique; 25% exfiltration technique
R03.05.01.03-T16 Merge duplicate alerts into one incident
Original instruction
Five alerts in the lab SIEM all describe the same 'VPN anomaly' event. Merge/link them into the oldest incident, mark the others as duplicates, notify the requester group via the case comment, and keep one authoritative timeline.
- Platforms
web· Any OS (web)- Applications
- Splunk
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
The five alerts are linked to the single oldest incident, four marked duplicate, a notify comment present. Graded on saved incident links/status. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.
Proposed partial credit
50% all linked to the oldest incident; 30% duplicates marked; 20% notify comment
R03.05.01.03-T17 Identify a DNS tunneling exfil domain
Original instruction
A high-entropy DNS alert fired in the lab SIEM. Investigate index=dns (synthetic) to find the domain whose subdomains carry encoded data, estimate the data volume, and record the exfil domain and the client host as indicators on the incident.
- Platforms
web· Any OS (web)- Applications
- Elastic Security · Splunk
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clickvis· Visual judgmenttype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Incident records the correct tunneling parent domain and client host matching lab ground truth. Graded on saved observables. No Splunk REST token or Kibana/Elasticsearch API key is issued and ports 8089/9200 are firewalled from the agent VM, so changes can be made only in the browser UIs.
Proposed partial credit
50% exfil domain; 30% client host; 20% volume estimate noted
R03.05.01.03-T18 Build an Elastic Timeline with pinned events
Original instruction
In the lab Elastic Security, open a new Timeline for incident INC-402, query the relevant endpoint/network indices, pin the 6 events that evidence the compromise in order, add a note to each pinned event, and attach the Timeline to the case.
- Platforms
web· Any OS (web)- Applications
- Elastic Security
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & formsdrag· Drag & drop- Work product
WP01· Document- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
The Timeline contains the 6 correct pinned events (matching lab key) in chronological order with notes, and is attached to the case. Graded on the saved Timeline/case state. No Kibana API key is issued and port 9200 is firewalled; the saved Timeline must carry the UI session in the Kibana audit log.
Proposed partial credit
40% six correct events pinned; 30% ordered with notes; 30% attached to case
R03.05.01.03-T19 Schedule a top-talkers report in Splunk
Original instruction
Create a saved Splunk report 'Daily Top Talkers' over index=netflow (synthetic) listing the top 10 internal hosts by outbound bytes, scheduled daily at 07:00, delivered to the lab SOC mailbox as a CSV attachment.
- Platforms
web· Any OS (web)- Applications
- Splunk
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
A saved report with the correct aggregation (values match seeded data), a daily 07:00 schedule, and a CSV email action to the lab mailbox exists. Graded on the saved report/schedule definition. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.
Proposed partial credit
50% correct top-10 aggregation; 30% schedule; 20% CSV email action
R03.05.01.03-T20 End-to-end incident investigation and report
Original instruction
Investigate incident INC-500 in the lab SIEM spanning mail, endpoint, auth, and proxy (synthetic). Reconstruct the full attack from initial access to exfiltration, add all entities/indicators, build an ordered timeline, assign MITRE techniques, and write a containment recommendation in the case.
- Platforms
web· Any OS (web)- Applications
- Sentinel · Splunk · Elastic Security
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
nav· Pan/zoom/scrollclick· Point & clicktype· Text & formsvis· Visual judgment- Work product
WP01· Document- Conditions
long· Long-horizonmultiapp· Multi-app- Proposed difficulty
- 5 / 5
Proposed verifier
Case contains the correct entities, an ordered end-to-end timeline matching lab ground truth, MITRE technique tags, and a containment recommendation; a rubric scores the narrative where no exact check exists. Graded on the saved case artifacts. No Splunk/Kibana API keys or Azure service principal are issued and API ports are firewalled from the agent VM, so the case can be edited only in the browser UIs.
Proposed partial credit
25% entities/indicators; 35% correct ordered timeline; 20% MITRE tags; 20% containment recommendation
Mapped research references
No benchmark reference is assigned to this class in the current mapping.