The first 15 minutes of an L1 alert

A Wazuh alert in a home lab looks serious. Often it is the same test sudo, SSH or Event ID you triggered five minutes earlier. L1 does not start with “incident!”. It starts with a note you can replay.

This is not someone else’s SOC and not an MTTA promise. It is what I write down before I touch a rule or isolation.

What the note must contain

Before you open another tab:

1. time with zone — 2026-09-13 11:27 Europe/Warsaw, not “just now”
2. host — name, IP if you know it, Windows or Linux
3. account / process — if the log has it; an empty field is still a fact
4. where the alert came from — rule id / name, not a full SIEM screenshot
5. raw fragment — one log line, or Event ID + channel
6. next question — one, not a tool list

Without 1–3, correlation with a second host lies. Without 4–5 you cannot tell a new detection from yesterday’s false positive.

The wider template (intake → facts → decision) lives in the IR checklist. This post is the first quarter-hour, before anyone names it a case.

Facts and hypothesis do not share a sentence

Bad: “Someone breached the Linux box because alert 5503 fired.”

Better:

• fact: sshd rejected a login on lab-linux at 11:27 from 192.168.56.10
• hypothesis: a scan from the neighbouring VM I start myself
• check: is that address in the lab; is it 1 attempt or 400; is there a successful login after auth

If you cannot replay the event (same command, same host, same log), you do not understand the detection yet. In a lab that is a feature: you can reproduce it. In production you often cannot — which is why the lab note trains discipline, not “hours saved in a SOC”.

What not to do in the first 15 minutes

• do not disable the rule because “too many alerts” — review the rule first
• do not reboot the host to “clean it”
• do not paste a whole dashboard into the ticket without time and host
• do not escalate the colour of the alert alone

The chain from the lab architecture note stays the same:

event → log → detection → alert → triage → note

SIEM is the middle link. If the note is empty, the alert changed nothing.

When it is only a lab

One person, one hypervisor, known tests — this is not a 24/7 shift. You may write: “reproduced, FP, leaving the rule because the condition is correct”. You may also write: “I don’t know; I need the auth log and NTP time”. Both sentences beat “incident in progress” with no host.