Triage the drift queue

Objectives

Overnight drift detection produced eight entries and you are on call with one pair of hands. Escalate only what represents a control that is not currently operating.

Everything else waits for the standup. Raise what qualifies, worst first.

List only the lines that qualify, worst first. Severity is one of: critical | high | medium | low. Add or delete rows as needed.

K-1  Production database security group open to 0.0.0.0/0, first seen this morning, still open.
K-2  Suppression on the public-bucket alert has been in place 14 months with no owner, reason or end date.
K-3  Break-glass admin role granted during an incident nine days ago and never revoked.
K-4  The team would prefer the drift job ran hourly rather than nightly.
K-5  Two intentional infrastructure changes merged yesterday afternoon appear in the diff.
K-6  Alerts route to a channel renamed last month that now has no members.
K-7  The alert message contains a spelling error in the runbook link text.
K-8  Cost-allocation automation changed resource tags exactly as declared in code.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the fixture as a population, not a list

   Separate three things: the estate changed, the monitoring changed, and someone would like the schedule changed. Only the first two can qualify.

2. Step 2

   Decide what actually qualifies

   Four entries mean a control is not operating: an open exposure, unrevoked emergency access, an indefinite suppression and an alert route with nobody on the other end.

   The right findings are raised

3. Step 3

   Resist the loud lines

   A scheduling preference, declared intentional changes and a typo are not control failures. Tag changes that match the declaration are the system working.

   Benign lines are left out

4. Step 4

   Grade the exposure, not the wording

   Live internet exposure of a production database outranks everything. Standing emergency privilege is next, because it is an open path rather than a possible one.

   An indefinite suppression and an empty alert channel both blind you rather than expose you, so they sit below the two live findings.

   Severity matches the actual exposure

5. Step 5

   Rank so the first line is the one you act on

   Rank by what an attacker could use tonight, then by what you have stopped being able to see.

   Ranked worst first

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.