Browser LabLD-DE-LAB-002Medium
Browser LabLD-DE-LAB-002Medium26 min
The Rule That Cried Wolf
A Jisr detection fires 180 times a day, and the SOC has started auto-closing it. Leadership asks whether the bank is under sustained attack. Your job is NOT to escalate an incident — it is to determine the truth. Analyze the alerts against the baseline and change records, and reach the honest verdict. A flood of alerts on legitimate activity is a tuning problem, not a breach.
What you will be able to do
- Distinguish a false-positive flood from a real attack.
- Identify the specific benign cause of the noise.
- Choose disciplined tuning over threshold-blunting.
Detection EngineeringLog AnalysisAnalyst Reporting
Sign in to start this lab.
Sign in