Home labs & practical projects
Tune an alert using event data
A project to do with your own tools, with guidance on what to create and capture.
What you could create
A sign-in alert creates too many cases. Analysts need to reduce avoidable noise without losing a deliberately planted suspicious sequence.
| Test case | Expected behaviour | Record |
|---|---|---|
| Repeated failures followed by a success | Investigate the sequence with user and source context | The matching events and your explanation |
What you'll need
Synthetic event dataset
Create a small CSV with timestamps, fictional users, source addresses, actions and outcomes. Include normal work and one suspicious sequence.
Query tool or spreadsheet
Use a tool you already have to filter and group events. Keep the detection rule readable and reproducible.
Investigation notebook
Record the rule, expected matches, observed matches and reasons for changes.
Access & cost
Uses your own computer. Confirm hardware capacity, software licences and download terms before setup.
Use disposable VMs, containers or a simulator. Keep the lab separate from your everyday machine and work network.
Suggested milestones
- 1
Define the detection question
Choose one pattern to investigate, such as repeated failed sign-ins followed by success. Explain why it matters and what else could cause it.
- 2
Build and run the first rule
Apply explicit grouping and time-window assumptions. Keep the matching records so another person can reproduce your result.
- 3
Investigate the noise
Add a plausible benign case. Explain why it triggered and change the rule only if the evidence supports the adjustment.
- 4
Retest and explain the limits
Run the suspicious and benign cases again. Record what the rule detects, what it misses and what additional context an analyst would need.
One example to adapt
| Test case | Expected behaviour | Record |
|---|---|---|
| Repeated failures followed by a success | Investigate the sequence with user and source context | The matching events and your explanation |
Useful resources
Use these resources to deepen your understanding and check key details.
Review the current provider requirements and relevant subject areas.
Check relevance, platform versions and current access terms.
Find relevant providers and check features, access requirements and costs.
A useful starting point
Create a CSV with synthetic normal sign-ins, repeated failures and one failure-then-success sequence. Label the expected outcomes before writing the query.
What a good result looks like
- Before-and-after results use the same labelled dataset.
- A lower alert count alone is not treated as improved detection.
Finish the project
Save sanitised evidence, then remove the lab instances or revert to the clean snapshot. Remove temporary accounts and credentials.
Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.