Re-rank your alert queue by consequence

applied · 70 min · Objective 4.1

Task

Apply objective 4.1: bring asset and identity context into the detection platform, re-rank the queue, and measure whether the serious findings moved up.

Steps

  1. Make asset context available at alert time: load classification, criticality, exposure and owner into the platform as a lookup, or enrich at ingest. Record how in lab/context-integration.md.
  2. Write a priority function combining rule severity with asset classification, identity privilege, exposure, corroboration and recent change. Record the weights and the reasoning.
  3. Rank a set of at least 30 alerts both ways and write lab/queue-compare.csv as alert,severity_rank,priority_rank,moved.
  4. Seed three alerts you KNOW are serious -- on a privileged identity, on an internet-facing asset, with two independent detections on one entity -- and record where each sat in both rankings.
  5. Compute the proportion of known-serious alerts in the top decile under each ranking and record it in lab/queue-measure.md.

Verify

awk -F, 'NR>1 {n++} END {print n" alert(s) ranked"}' lab/queue-compare.csv
awk -F, 'NR>1 && $4+0>5 {n++} END {print n+0" moved more than five places"}' lab/queue-compare.csv
grep -Ec '[0-9]+' lab/queue-measure.md
grep -Eci 'classification|privilege|exposure|corroborat' lab/context-integration.md

Thirty or more alerts ranked both ways, movement recorded, and the top-decile proportion computed for each. If serious findings are routinely found low in the queue, that is a design finding about context availability, not a performance finding about analysts.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.