TryHackMe | SOC L1 Alert Triage — Walkthrough

Learn more about SOC alerts and build a systematic approach to efficiently triaging them.

Room Link: https://tryhackme.com/room/socl1alerttriage

Task 1: Introduction

The room focuses on the concept of alerts and how to use them properly to determine if a security breach has occurred. This task has no questions to answer, and you can simply join the room. You are advised to open the SOC Dashboard link and take a look at the web page as you will refer to it in upcoming tasks.

Task 2: Events and Alerts

This task summarizes how alerts are generated from raw system logs and events collected from various parts in a system using specialized solutions like SIEM or EDR. These security solutions generate alerts from specific events, allowing the analysts to inspect just a few alerts rather than million of events.

Q: What is the number of alerts you see in the SOC dashboard?

A: Switch to the TryHackMe SIEM window. There are a total of 5 alerts.

Q: What is the name of the most recent alert you see?

A: The most recent alert is the one with Time: Mar 21st 2025 at 13:58, which is a Double-Extension File Creation alert.

Task 3: Alert Properties

This task goes over the essential properties of an alert, summarized as the following:

Alert Time: the time the alert has been triggered, and the time of the event that trigged it

Alert Name: summary of what happened

Alert Severity: urgency level of the alert

Alert Status: whether the alert is currently being worked on or not

Alert Verdict: classification of the alert: whether it was a real threat or not

Alert Assignee: the analyst reviewing the alert

Alert Description: what the alert is about

Alert Fields: analysts’ comments and provided information on the alert

Q: What was the verdict for the “Unusual VPN Login Location” alert?

A: Find the “Unusual VPN Login Location” alert in the dashboard.

Its verdict is False Positive.

Q: What user was mentioned in the “Unusual VPN Login Location” alert?

A: Click the arrow under the Actions column of the alert. This will show more information about the alert.

The user mentioned is M.Clark.

Task 4: Alert Prioritisation

This task introduces simple rules to decide which alert you should deal with first.

1- Filter for unresolved alerts

2- Start with the most severe alerts

3- Start with the oldest alerts

Q: Should you first prioritise medium over low severity alerts? (Yea/Nay)

A: The answer is Yea as medium level has higher severity than low level alerts.

Q: Should you first take the newest alerts and then the older ones? (Yea/Nay)

A: The older ones should be handled first, so the answer is Nay.

Q: Assign yourself to the first-priority alert and change its status to In Progress. The name of your selected alert will be the answer to the question.

A: Find the most severe alert in the dashboard, the one with the Critical level.

Click on the pen icon under Actions. This will open the Edit Alert window.

To assign yourself, click on the Assignee field to open the dropdown then select You (L1). After that click Save. The answer to the question is the event’s name, which is Potential Data Exfiltration.

Task 5: Alert Triage

Q: Which flag did you receive after you correctly triaged the first-priority alert?

A: First, locate the alert with the highest priority (Critical), which is named “Potential Data Exfiltration.” Then, as in the previous task, assign yourself to the task using the Edit Alert Window. Then set the status to In Progress then save the changes.

Next, expand the information of the alert to read the the alert description and details.

Judging by the destination and source networks, it appears that the gigabytes of data were zoom meeting streams. In this case, this is not an actual threat. Edit the alert and set the Verdict to False Positive.

Finally, set the status to Closed and add a comment then save the changes.

The flag should appear after you click save.

Q: Which flag did you receive after you correctly triaged the second-priority alert?

A: Like the previous question, locate the alert, assign yourself to it, and set the status to In Progress. The target alert is “Double-Extension File Creation.”

Next, view the alert’s description and details.

From the information provided, we can concluded this is indeed a threat that tricks users to run an executable disguised as a video. We will set the verdict to True Positive, add a comment, and set the status to Closed.

Now, you should receive the flag.

Q: Which flag did you receive after you correctly triaged the third-priority alert?

A: We will do the same procedure to the alert with the low severity, named “Download from GitHub Repository.”

Next, view the alert’s description and details.

From the information, we can tell the user attempted to download React, a library for web development. In this case, the alert is not a threat. We will set the verdict to False Positive and close the alert.

Now, you will receive the flag.

Task 6: Conclusion