SOC & Detection Questions
Part of the Cybersecurity Roadmap
In short
"How would you triage this alert?" tests whether you can stay calm, gather context fast and decide. A clear routine matters more than knowing every tool.
'How would you triage this alert?' or 'what's the MITRE ATT&CK framework?' — testing Phase 7's SOC operations and detection engineering knowledge against a practical scenario.
Think of it like this
The hospital triage nurse
In a busy emergency ward, the triage nurse quickly checks each patient: breathing, pain, history. Serious cases go straight to doctors; minor ones wait or go home. A SOC analyst triages alerts the same way, so the dangerous ones get attention first.
Watch it happen
Working the alert queue
Front of the queue is coloured
1/6Alert one arrives: forty failed logins for one user from one IP.
The big ideas
What you need to know
Context first
Ask: which user, which asset, how critical, is this normal for them? Context turns noise into decisions.
Know MITRE ATT&CK
Explain it as a catalogue of attacker tactics and techniques used to map detections and find gaps.
True vs false positive
Be ready to explain both, plus how you would tune a noisy rule without blinding yourself.
Severity beats order
In a real queue, pick the highest risk alert first, not just the oldest.
See it in code
A tiny example
1index=linux sourcetype=linux_secure "Failed password"2| stats count by src_ip, user3| where count > 104| sort - countA Splunk style search you might be asked to read or write: count failed SSH passwords by source and user, show only the noisy ones.
Save yourself the pain
Common mistakes
Oops
Closing alerts based only on the alert title.
Do this instead
Check the raw events and context. Titles can be vague, and real attacks hide in boring looking alerts.
Oops
Answering that you would escalate everything to be safe.
Do this instead
Escalating everything floods senior staff. Show you can triage and justify each decision.
Your mission
Triage practice in a free room
Quick check
Two alerts: 40 failed logins with no success, and a new admin account created at 3 am with no ticket. Which first?
Go deeper
- 1Review Phase 7 and practice triaging a sample alert scenario out loud.
- 2Prepare to explain how you'd distinguish a false positive from a real threat.
- 3Practice referencing MITRE ATT&CK to describe a hypothetical attack's stages.
More offensive & defensive security at this stop
Penetration Testing Scenario Questions
Incident Response Scenario Questions
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
