Triage a SOC alert queue
Work a realistic alert queue the way a junior analyst does: separate noise from signal, correlate related alerts, and decide what to escalate first.
Start of shift, 15 alerts in the queue, and you are the only analyst on. You will not work all of them carefully before more arrive. The skill here is not clearing the queue — it is deciding, fast and defensibly, which alerts matter and which can wait.
1 Guided walkthrough
Create a workspace (or reuse "Log analysis") and upload alerts.csv. Wait for it to finish embedding.
Before you ask the AI anything, do your own triage: skim the 15 rows and pick your top three to act on. You will compare against the AI at the end.
Ask it to rank the queue.
Paste this into the assistantThis is a SOC alert queue. Rank all of these alerts from most to least urgent for an analyst to respond to, and give a one-sentence reason for each.You should see: The critical rows — a UID 0 account created, and the bulk data exports — rank at the top.
Now the skill that separates an analyst from a checklist: correlation.
Paste this into the assistantWhich of these alerts appear to be part of the SAME incident rather than separate problems? Explain how they connect.You should see: It groups the brute force, the successful login, the new UID 0 account, the SQL injection, and the data exports into one story tied to 203.0.113.47.
And the other half of triage — what to ignore.
Paste this into the assistantWhich of these alerts are most likely routine noise that a SOC could safely deprioritise, and why?You should see: NTP drift, disk usage, and the approved-browser-list policy alert get called out as low-value noise.
Compare the AI's ranking to the three you picked. Where you disagree, decide who is right — and notice where the AI sounded confident but was off.
2 Run the queue like it is your shift
No prompts given this time — you write them. Forming the right question is the skill. Work these on your own; compare with a neighbour if you can.
- Write a prioritized action plan for your top three alerts: for each, what is the single FIRST thing you do?
- Decide your escalations: which alerts go to the incident-response team, each with a one-line justification?
- For the alerts you called noise, draft a specific tuning recommendation so they stop paging you — name the condition you would change.
- Cross-check against the raw logs from the log-analysis lab: do these alerts actually match what happened on web01, or is the queue missing something the logs show?
What to notice
- The critical alerts (UID 0 account created, data exported) belong to one story, not four separate problems — correlation is the analyst's real skill.
- Some alerts (NTP drift, disk usage, approved-browser policy) are noise on this queue. Knowing what to ignore matters as much as what to chase.
- The AI ranks confidently even when it is wrong. Treating its output as a draft to check, not an answer to trust, is the professional habit to build.
Think about it
- Where did the AI's ranking differ from yours? On the disagreements, who was right — and how did you decide?
- A wrong "low priority" call is more dangerous than a wrong "high priority" one. Did the AI make any dangerous downgrades?
Take it further — for fast finishers
- Ask the AI to estimate, per alert, what an attacker gains if it is ignored. Does reframing around attacker payoff change your priorities?