R03.05.01.03 · 任务小类

SOC告警分诊与SIEM调查

SOC alert triage & SIEM investigation

Triage alerts, pivot through logs and write an incident timeline in SIEM consoles.

20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。

典型应用: Splunk · Elastic Security · Sentinel
小类 GUI 需求标签: G2 · GUI 必要

任务提案 · 20

展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。

R03.05.01.03-T01 Triage an SSH brute-force alert in Splunk

原始指令

In the lab Splunk instance (index=auth seeded with synthetic logs), open alert AL-1007 'Multiple failed logins'. Determine the attacking source IP and the count of failures, confirm whether any succeeded, and record the finding in the notable event's comment plus an incident timeline note.

平台: web · 任意系统（网页）
应用: Splunk
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单 vis · 视觉判断
工作产物: WP01 · 文档
条件: 未声明
提案难度: 3 / 5

建议验证方式

Notable AL-1007 has a comment stating the correct source IP and failure count (match lab ground truth) and the right TP/FP disposition; a timeline note records the success/no-success verdict. Graded on the console's saved notable/comment state, not a raw REST dump. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.

建议部分得分

40% correct source IP; 30% failure count + success verdict; 30% disposition recorded in the notable

R03.05.01.03-T02 Build a failed-login dashboard panel in Splunk

原始指令

Create a Splunk dashboard 'Auth Monitor' with a panel showing failed logins per hour for the last 24h (synthetic index=auth) and a second panel listing the top 10 source IPs by failures. Save the dashboard and set the time range picker to default to 24h.

平台: web · 任意系统（网页）
应用: Splunk
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Dashboard 'Auth Monitor' exists with the two panels whose searches aggregate failed logins correctly (values match the seeded data); default time range is 24h. Graded on saved dashboard XML/state in the console. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.

建议部分得分

40% per-hour timechart panel; 40% top-10 source IP panel; 20% saved with 24h default

R03.05.01.03-T03 Tune a noisy Elastic detection rule

原始指令

In the lab Elastic Security (Kibana), rule 'Unusual Process' fires on a benign backup job. Without disabling the rule, add a tuning exception so the backup process (given in notes) no longer alerts while real anomalies still do. Document the exception rationale.

平台: web · 任意系统（网页）
应用: Elastic Security
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Rule has an exception matching the backup process only; re-running the rule over the seeded data suppresses the benign alerts and keeps the 2 true anomalies; exception note present. Graded on the rule's saved exception list and alert outcomes in the app. No Kibana or Elasticsearch API key is issued and port 9200 is firewalled; the Kibana audit log must tie each change to a browser session id.

建议部分得分

40% scoped exception added; 40% benign suppressed + true alerts kept; 20% rationale documented

R03.05.01.03-T04 Trace lateral movement across sources in Sentinel

原始指令

In the lab Microsoft Sentinel workspace (synthetic SigninLogs, DeviceLogon, Proxy), incident INC-204 flags a suspicious account. Pivot across the sources to reconstruct the account's path between hosts, add the involved entities to the incident, and write an ordered incident timeline of the lateral movement.

平台: web · 任意系统（网页）
应用: Sentinel
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单 vis · 视觉判断
工作产物: WP01 · 文档
条件: long · 长流程
提案难度: 5 / 5

建议验证方式

Incident INC-204 has the correct account+host+IP entities added and an ordered timeline naming the hop sequence matching lab ground truth; severity set per playbook. Graded on the saved incident entities/comments/timeline in Sentinel. The agent has only an interactive Azure portal login (no service principal, Azure CLI or Graph/ARM token), and Activity Log must show each change came from the portal browser session.

建议部分得分

30% correct entities added; 40% hop sequence correct+ordered; 30% severity+timeline recorded

R03.05.01.03-T05 Disposition a batch of 10 alerts

原始指令

Ten open alerts are queued in the lab SIEM. For each, investigate the seeded evidence and set disposition True Positive or False Positive with a one-line justification, then assign the TPs to the 'IR' queue. Leave no alert in the New state.

平台: web · 任意系统（网页）
应用: Splunk · Elastic Security
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

All 10 alerts have a disposition matching the lab answer key (>=8/10 to pass), each with a non-empty justification; TPs are assigned to IR. Graded on saved alert status/owner fields. No Splunk REST token or Kibana/Elasticsearch API key is issued and ports 8089/9200 are firewalled from the agent VM, so changes can be made only in the browser UIs.

建议部分得分

60% dispositions match key; 20% justifications present; 20% TPs routed to IR

R03.05.01.03-T06 Assemble a phishing kill-chain

原始指令

Alert 'Suspicious attachment' fired in the lab SIEM (synthetic mail, endpoint, proxy logs). Identify the recipient who opened the attachment, the spawned process, and the first outbound connection. Build the kill-chain in the incident with each stage as a timeline entry and set severity High.

平台: web · 任意系统（网页）
应用: Elastic Security
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单 vis · 视觉判断
工作产物: WP01 · 文档
条件: 未声明
提案难度: 4 / 5

建议验证方式

Incident timeline lists recipient, process, and first C2 connection matching lab ground truth, in order; severity High. Graded on the saved incident timeline/entities. No Kibana or Elasticsearch API key is issued and port 9200 is firewalled; the Kibana audit log must tie each change to a browser session id.

建议部分得分

30% recipient identified; 30% spawned process; 20% first outbound; 20% ordered timeline+severity

R03.05.01.03-T07 Create a Sentinel analytics rule with grouping

原始指令

In the lab Sentinel, create a scheduled analytics rule from the provided KQL that detects >5 failed MFA challenges in 10 min per user. Map it to the right MITRE tactic, group alerts into one incident per user, and run it once to confirm it generates the expected incidents.

平台: web · 任意系统（网页）
应用: Sentinel
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Rule exists with the KQL, 10-min window, per-user alert grouping, and the correct MITRE mapping; a test run yields exactly the expected number of incidents on the seeded data. Graded on the saved rule config and generated incidents. The agent has only an interactive Azure portal login (no service principal, Azure CLI or Graph/ARM token), and Activity Log must show each change came from the portal browser session.

建议部分得分

40% rule with correct logic/window; 30% per-user grouping; 30% MITRE map + expected incidents

R03.05.01.03-T08 Write an SPL exfil search and save as alert

原始指令

In Splunk, write an SPL search over index=proxy (synthetic) that flags any internal host sending >50 MB outbound to a single external host in 1h. Verify it finds the one seeded exfil host, then save it as a scheduled alert that emails the SOC (lab mailbox).

平台: web · 任意系统（网页）
应用: Splunk
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 type · 文字与表单 click · 指向与点击
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

The search returns the one correct host over the seeded data; a saved scheduled alert exists with the threshold and the lab email action. Graded on the saved search/alert definition and result. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.

建议部分得分

50% search finds the exfil host; 30% correct threshold/window; 20% saved as scheduled alert

R03.05.01.03-T09 Extract C2 indicators from a beacon pattern

原始指令

A beaconing alert fired in the lab SIEM. Investigate the periodic connections in index=proxy, identify the C2 domain, IP, and the regular beacon interval, and record all three as indicators on the incident case. Flag the suspected agent process on the host.

平台: web · 任意系统（网页）
应用: Splunk · Elastic Security
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 vis · 视觉判断 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Incident holds the correct C2 domain, IP, and beacon interval (within tolerance) and the correct process name, matching lab ground truth. Graded on saved case indicators/observables. No Splunk REST token or Kibana/Elasticsearch API key is issued and ports 8089/9200 are firewalled from the agent VM, so changes can be made only in the browser UIs.

建议部分得分

30% C2 domain; 30% C2 IP; 20% interval; 20% process

R03.05.01.03-T10 Add entities and set severity on an incident

原始指令

Open incident INC-311 in the lab SIEM. From the linked alert, add the user, host, and source IP as entities, set severity Medium, assign it to analyst 'you', and move it from New to Active. Leave a one-line triage note.

平台: web · 任意系统（网页）
应用: Sentinel
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

INC-311 has the three correct entities, severity Medium, owner set, status Active, and a non-empty note. Graded on saved incident fields. The agent has only an interactive Azure portal login (no service principal, Azure CLI or Graph/ARM token), and Activity Log must show each change came from the portal browser session.

建议部分得分

40% three entities added; 30% severity+owner+status; 30% triage note

R03.05.01.03-T11 Timeline a Windows privilege escalation

原始指令

From the seeded Windows Security events in the lab SIEM, reconstruct how a standard user gained admin: the 4672/4688 events, the tool used, and the new admin group membership. Build an ordered incident timeline and name the escalation technique.

平台: web · 任意系统（网页）
应用: Elastic Security · Splunk
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 vis · 视觉判断 type · 文字与表单
工作产物: WP01 · 文档
条件: 未声明
提案难度: 4 / 5

建议验证方式

Timeline lists the triggering process, the privilege-assignment event, and the group change in correct order matching lab ground truth; technique named. Graded on saved incident timeline. No Splunk REST token or Kibana/Elasticsearch API key is issued and ports 8089/9200 are firewalled from the agent VM, so changes can be made only in the browser UIs.

建议部分得分

30% key events found; 40% correct ordering; 30% technique named

R03.05.01.03-T12 Suppress a benign alert with an exception

原始指令

Alert 'PowerShell download' fires daily from a sanctioned admin script in the lab SIEM. Add a precise suppression/exception for that script path and signer only, so future runs are suppressed but other PowerShell downloads still alert. Document why.

平台: web · 任意系统（网页）
应用: Elastic Security
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

Exception matches only the sanctioned script path/signer; re-running over seeded data suppresses the benign events and keeps 2 unsanctioned ones; rationale note present. Graded on the saved exception and outcomes. No Kibana or Elasticsearch API key is issued and port 9200 is firewalled; the Kibana audit log must tie each change to a browser session id.

建议部分得分

50% scoped exception; 30% benign suppressed + others kept; 20% rationale

R03.05.01.03-T13 Hunt with KQL and pin findings in Sentinel

原始指令

In the lab Sentinel, run a provided hunting query for rare parent-child process pairs over the synthetic DeviceProcessEvents. Identify the two suspicious pairs, bookmark them, and promote them into a new incident with notes.

平台: web · 任意系统（网页）
应用: Sentinel
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单 vis · 视觉判断
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

The two correct process pairs are bookmarked and attached to a new incident with notes matching lab ground truth. Graded on saved bookmarks and the created incident. The agent has only an interactive Azure portal login (no service principal, Azure CLI or Graph/ARM token), and Activity Log must show each change came from the portal browser session.

建议部分得分

50% both suspicious pairs identified; 30% bookmarked; 20% promoted to incident with notes

R03.05.01.03-T14 Compute attacker dwell time

原始指令

Using the seeded multi-source logs for incident INC-150 in the lab SIEM, determine the timestamp of first compromise and the timestamp of detection, compute the dwell time in hours, and record all three on the incident.

平台: web · 任意系统（网页）
应用: Splunk
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 vis · 视觉判断 type · 文字与表单
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

Recorded first-compromise and detection timestamps match lab ground truth (within 1 min) and the dwell hours are consistent. Graded on saved incident fields. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.

建议部分得分

40% first-compromise time; 40% detection time; 20% dwell computed

R03.05.01.03-T15 Map incident activity to MITRE ATT&CK

原始指令

For incident INC-150 in the lab SIEM, review the collected evidence and tag each stage with the correct MITRE ATT&CK technique ID (initial access, execution, persistence, exfiltration). Add the technique list to the incident.

平台: web · 任意系统（网页）
应用: Sentinel · Elastic Security
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

The four technique IDs recorded on the incident match the lab answer key (>=3/4 to pass). Graded on saved incident technique tags/comments. No Azure service principal, CLI credential or Kibana/Elasticsearch API key is issued to the agent, so the incident can be edited only in the browser (Sentinel and Kibana UIs).

建议部分得分

25% initial-access technique; 25% execution technique; 25% persistence technique; 25% exfiltration technique

R03.05.01.03-T16 Merge duplicate alerts into one incident

原始指令

Five alerts in the lab SIEM all describe the same 'VPN anomaly' event. Merge/link them into the oldest incident, mark the others as duplicates, notify the requester group via the case comment, and keep one authoritative timeline.

平台: web · 任意系统（网页）
应用: Splunk
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

The five alerts are linked to the single oldest incident, four marked duplicate, a notify comment present. Graded on saved incident links/status. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.

建议部分得分

50% all linked to the oldest incident; 30% duplicates marked; 20% notify comment

R03.05.01.03-T17 Identify a DNS tunneling exfil domain

原始指令

A high-entropy DNS alert fired in the lab SIEM. Investigate index=dns (synthetic) to find the domain whose subdomains carry encoded data, estimate the data volume, and record the exfil domain and the client host as indicators on the incident.

平台: web · 任意系统（网页）
应用: Elastic Security · Splunk
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 vis · 视觉判断 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

Incident records the correct tunneling parent domain and client host matching lab ground truth. Graded on saved observables. No Splunk REST token or Kibana/Elasticsearch API key is issued and ports 8089/9200 are firewalled from the agent VM, so changes can be made only in the browser UIs.

建议部分得分

50% exfil domain; 30% client host; 20% volume estimate noted

R03.05.01.03-T18 Build an Elastic Timeline with pinned events

原始指令

In the lab Elastic Security, open a new Timeline for incident INC-402, query the relevant endpoint/network indices, pin the 6 events that evidence the compromise in order, add a note to each pinned event, and attach the Timeline to the case.

平台: web · 任意系统（网页）
应用: Elastic Security
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单 drag · 拖放
工作产物: WP01 · 文档
条件: 未声明
提案难度: 4 / 5

建议验证方式

The Timeline contains the 6 correct pinned events (matching lab key) in chronological order with notes, and is attached to the case. Graded on the saved Timeline/case state. No Kibana API key is issued and port 9200 is firewalled; the saved Timeline must carry the UI session in the Kibana audit log.

建议部分得分

40% six correct events pinned; 30% ordered with notes; 30% attached to case

R03.05.01.03-T19 Schedule a top-talkers report in Splunk

原始指令

Create a saved Splunk report 'Daily Top Talkers' over index=netflow (synthetic) listing the top 10 internal hosts by outbound bytes, scheduled daily at 07:00, delivered to the lab SOC mailbox as a CSV attachment.

平台: web · 任意系统（网页）
应用: Splunk
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 2 / 5

建议验证方式

A saved report with the correct aggregation (values match seeded data), a daily 07:00 schedule, and a CSV email action to the lab mailbox exists. Graded on the saved report/schedule definition. No Splunk REST token is issued and management port 8089 is firewalled from the agent VM, so changes can be made only in Splunk Web.

建议部分得分

50% correct top-10 aggregation; 30% schedule; 20% CSV email action

R03.05.01.03-T20 End-to-end incident investigation and report

原始指令

Investigate incident INC-500 in the lab SIEM spanning mail, endpoint, auth, and proxy (synthetic). Reconstruct the full attack from initial access to exfiltration, add all entities/indicators, build an ordered timeline, assign MITRE techniques, and write a containment recommendation in the case.

平台: web · 任意系统（网页）
应用: Sentinel · Splunk · Elastic Security
交互表面: brow · 浏览器
GUI 需求 · 任务设定: G2 · GUI 必要
GUI 需求 · 普通权限: G2 · GUI 必要
交互原语: nav · 平移 / 缩放 / 滚动 click · 指向与点击 type · 文字与表单 vis · 视觉判断
工作产物: WP01 · 文档
条件: long · 长流程 multiapp · 多应用
提案难度: 5 / 5

建议验证方式

Case contains the correct entities, an ordered end-to-end timeline matching lab ground truth, MITRE technique tags, and a containment recommendation; a rubric scores the narrative where no exact check exists. Graded on the saved case artifacts. No Splunk/Kibana API keys or Azure service principal are issued and API ports are firewalled from the agent VM, so the case can be edited only in the browser UIs.

建议部分得分

25% entities/indicators; 35% correct ordered timeline; 20% MITRE tags; 20% containment recommendation

已有研究映射

当前映射未给此小类指定基准参考。

SOC告警分诊与SIEM调查

任务提案 · 20

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

已有研究映射

同工作流族的小类