Incident › Module 4 › Lesson 1
Detection Intake
Detection intake literacy names alert sources, triage fields, and escalation criteria — practice intake forms on YOUR $IR_LAB tabletop alerts.
Visual · t34_detection_intake
Detection intake literacy. $IR_LAB only. Original Cyberlium.
Opening
Every incident starts as a signal — literacy teaches intake triage so tabletop alerts enter IR with consistent fields you document.
Detection intake captures how alerts and reports enter IR — SIEM rules, EDR detections, user reports, threat intel matches. Triage fields include timestamp, source, affected asset, initial severity guess, and assigned analyst. Escalation criteria tie to severity matrix — e.g., lateral movement observed triggers IC page. Cyberlium practices intake on YOUR $IR_LAB — write intake row for three fictional tabletop alerts. Next: Analysis Named.
1. Intake components (named)
Sources: SIEM correlation, EDR alert, phishing report, vuln scanner, ISAC feed — lab-labeled on $IR_LAB. Triage fields: time, source, asset, technique hint, preliminary severity. Routing: SOC tier-1 vs IR tier-2 vs hunt queue.
On $IR_LAB, write intake row — alert ID, source, asset placeholder, triage decision for fictional inject.
Command guide
Try these commands — Intake components (named)
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS IR (https://www.sans.org/for-organizations/incident-response/); CISA (https://www.cisa.gov/stopransomware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why intake literacy reduces duplicate tickets and missed escalations
Incomplete intake sends analysts hunting without asset context. Missing escalation criteria delay IC involvement on true P1s. Standard forms speed tabletop and production consistency.
Students triage lab alerts on notes — production intake follows ticketing and SOAR automation.
3. Lab boundary
Forbidden: intake rows with live victim PII or stranger-network asset IDs without scope. Allowed: detection intake card — three fictional alerts with triage fields on $IR_LAB.
Ship: detection intake card for YOUR lab alerts. Next: Analysis Named.
4. What you ship: detection intake card for $IR_LAB
Three fictional alert intake rows with triage fields. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Detection intake card. $IR_LAB named. File t34-m04-l01-detection-intake.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip triage fields and escalate everything to IC. Paste live victim alert exports into lab.
Right
Write detection intake card for YOUR $IR_LAB. Next: Analysis Named.
Mission: triage intake on YOUR lab alerts
1) List five intake sources. 2) Write intake rows for three fictional alerts. 3) Note escalation trigger per row. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Asset and time on every row — intake without context wastes the next analyst.
Knowledge Check
APPLY: Detection intake primarily captures:
Multiple choice
Knowledge Check
APPLY: True or False: Escalation criteria should tie to severity matrix thresholds.
True or False
Knowledge Check
APPLY: Detection intake literacy on Cyberlium uses:
Multiple choice