Automate the enrichment, keep the decision

short · 50 min · Objective 1.5

Task

Take the most repetitive part of your alert triage, automate exactly that, and measure what it saved -- while deliberately leaving the judgement call manual. Then break the automation and watch what your triage does when its enrichment is silently wrong.

Steps

  1. Time yourself triaging five alerts from your earlier labs by hand. Write down which steps were mechanical -- looking up the host, the account's recent history, whether this file has been seen before -- and which required a decision.
  2. Write a script that performs only the mechanical steps and prints an enrichment block: hostname, owner, the account's logins in the last 24 hours, and how many times this process name has appeared on this host.
  3. Re-triage five more alerts with the enrichment in hand. Time it again.
  4. Now sabotage it: change the script so the "logins in the last 24 hours" lookup silently returns 0 when the log file is missing, rather than erroring. Rename the log file and re-run.
  5. Triage one more alert using the sabotaged output. Notice that the enrichment looks entirely normal and is completely wrong, and that nothing in the output distinguishes "no logins" from "could not look up logins".

Verify

python3 /tmp/enrich.py testhost | tee /tmp/enrich-good.txt | wc -l
mv /var/log/collected/auth.log /var/log/collected/auth.log.bak
python3 /tmp/enrich.py testhost | tee /tmp/enrich-bad.txt | wc -l
diff /tmp/enrich-good.txt /tmp/enrich-bad.txt | wc -l
mv /var/log/collected/auth.log.bak /var/log/collected/auth.log

The last count is the finding. If the diff is small -- the only change being a count going to zero -- your automation reports "no evidence" and "could not look" identically, which is the failure this whole course is about. Fix the script so the missing source is an explicit third state, then re-run and confirm the diff now says so.

Notes

The saved time from step 3 is the number people quote. The diff from step 5 is the number that matters, because an enrichment that fails quietly makes every downstream decision confidently wrong.

Keep the judgement manual. You automated the lookups, not the disposition, and the moment the script starts closing alerts you have moved the failure from slow to invisible.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.