grceng.academy
Triage lab 40 bonus XP

Triage the monitoring alerts

Start labRead the room

Objectives

Your continuous monitoring stack raised eight alerts overnight. The on-call GRC engineer has 30 minutes before standup.

Raise the alerts that indicate a real control failure. Leave the ones that indicate a monitoring artefact.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

Overnight alert queue

A-1  Monitor for admin MFA has not reported in 9 days; no alert was raised about its silence.
A-2  Threshold alert: privileged accounts rose from 12 to 47 in one hour.
A-3  Alert fired because the monitor's own credential expired; control state unknown since.
A-4  Alert: nightly backup job completed 20 minutes later than usual.
A-5  Drift detected: production security group opened 0.0.0.0/0 on port 22, still open.
A-6  Alert: same finding re-raised for the 340th consecutive night, ticket open, accepted risk documented.
A-7  Alert: monitor reports 0 resources in scope after a tag rename; reads as fully compliant.
A-8  Alert: CPU on the monitoring host at 78%.

Checks the server runs (4)

  • The right findings are raised
  • Benign lines are left out
  • Severity matches the actual exposure
  • Ranked worst first

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Read the fixture as a population, not a list

    Continuous monitoring produces two kinds of alert: something changed in the estate, and something changed in the monitoring. Both matter; only some are control failures.

  2. Step 2

    Decide what actually qualifies

    Four entries mean you currently cannot assert a control: an open SSH exposure, a privilege spike, a silent monitor, and a scope that collapsed to zero and reads as compliant.

    The right findings are raised

  3. Step 3

    Resist the loud lines

    Host CPU, a late backup and a long-accepted repeat finding are all noise for this purpose: the last one is a risk decision already recorded, not a new failure.

    Benign lines are left out

  4. Step 4

    Grade the exposure, not the wording

    An exploitable exposure that is still open outranks everything else. A privilege spike is next because it may be an attack in progress.

    Silence and a zero-scope monitor sit below live exposure but above everything operational, because they remove your ability to see.

    Severity matches the actual exposure

  5. Step 5

    Rank so the first line is the one you act on

    Rank by what you would act on first at 3am with one pair of hands.

    Ranked worst first

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.