Lab 6.4 — Alert Queue Challenge

Lab Overview

The Scenario

You are taking over the 06:00–14:00 shift. The overnight analyst left no handoff note (this happens). Your Wazuh Dashboard shows 50 unreviewed alerts from the past 8 hours across these agents:

Click to enlarge

Phase 1: Rapid Severity Sort (10 minutes)

Step 1: Get the Big Picture

Before touching any individual alert, understand what you're dealing with:

1. Navigate to Security Events → set time range to Last 24 hours
2. Sort by rule.level (descending) to see critical alerts first
3. Count the breakdown:

Step 2: Identify the "Must-Touch" Alerts

Critical and high-severity alerts (rule.level >= 12) are your first priority. These represent potential active threats. Scan their rule descriptions and group them:

• Are multiple critical alerts related to the same host or IP? (likely a single incident)
• Are any critical alerts about data exfiltration, lateral movement, or active exploitation? (handle first)
• Are any critical alerts known false positives you can close quickly? (clear the noise fast)

Phase 2: Triage the Top 10 (40 minutes)

Work through the 10 most critical alerts. For each:

Full Triage Checklist

Common Alert Types You'll Encounter

Phase 3: Batch-Close False Positives (15 minutes)

After triaging the top 10, work through the remaining alerts looking for obvious false positive patterns you can close quickly:

Quick-Close Criteria

Phase 4: Write the Shift Handoff Note (15 minutes)

This is the most important deliverable. The next analyst relies on this document to continue where you left off.

Click to enlarge

Handoff Note Template

# Shift Handoff: [Date] — 06:00-14:00

## Shift Summary
- Total alerts reviewed: X/50
- True Positives escalated: X
- False Positives closed: X
- Requires further investigation: X

## Active Incidents

### Incident 1: [Title]
- **First alert:** [timestamp] — [rule description]
- **Affected assets:** [hosts/users]
- **Current status:** [escalated / under investigation / contained]
- **Action needed:** [what the next analyst should do]

### Incident 2: [Title]
(repeat for each active incident)

## Closed False Positives (Notable)
- [Brief description of any unusual FPs worth noting]

## Open Items for Next Shift
- [ ] [Specific follow-up task 1]
- [ ] [Specific follow-up task 2]
- [ ] [Specific follow-up task 3]

## Recommendations
- [Any tuning suggestions to reduce FP volume]
- [Any new IOCs to add to blocklists]

Deliverable

Your final Shift Handoff Note must include:

1. Shift Summary — counts of alerts reviewed, TPs, FPs, and open items
2. Active Incidents — at least 2-3 incidents with status and next steps
3. Open Items — specific tasks the next analyst should prioritize
4. Recommendations — at least 1 tuning suggestion based on FP patterns observed

What's Next

Congratulations — you've completed the Alert Triage module. You can now triage individual alerts, investigate suspicious events in depth, decode obfuscated payloads, and manage a full alert queue. Next, Module 7 takes you into Threat Intelligence, where you'll learn to use MISP and external intel to investigate faster and smarter.