Lion Cipher Lab

Build a risk-based alerting (RBA) engine from scratch

• SOC Analyst / Blue Team
• Advanced
• ~75 min
• Free · no account required

Why it matters

A SOC does not drown because it misses signals -- it drowns because every weak signal becomes its own alert. One login from a new country. One encoded PowerShell command. One impossible-travel event. Each is individually too weak to page a human on (fire an alert on every new-country login and you will page 200 times a day on sales reps and VPN egress), so teams either mute them -- and miss the one that mattered -- or alert on them and bury the analyst. Risk-based alerting is the way out, and it is a genuinely different SHAPE of detection: instead of one-alert-per-signal, you attribute a…

What you'll learn

• the RBA mental model: attribute a numeric RISK SCORE to each low-fidelity observation instead of one-alert-per-signal
• aggregating risk per ENTITY (a user or host) over a sliding time window and raising an incident only when cumulative risk crosses a threshold
• generating a realistic mixed event stream (benign noise + chatty-but-benign infra + one planted attacker) tagged with entity, timestamp, and MITRE ATT&CK technique
• assigning per-signal FIDELITY weights and seeing why flat weights fail
• exponential time decay (a half-life) so recent, clustered behavior weighs more than a signal from 20 hours ago
• per-entity BASELINE normalization so a busy-but-normal service account does not float to the top
• measuring the win with numbers: alert-volume reduction (a suppression ratio) and precision before vs after
• the base-rate problem, score inflation, and entity resolution (the same human across a user account and a host)
• the judgment call: when RBA beats per-signal alerting and when a single CRITICAL signal must page immediately anyway
• how Splunk ES RBA and Elastic entity risk scoring productionize the exact math you just wrote

Steps in this lab

1. The idea: risk scores per entity, not one alert per signal
2. When RBA is the right tool -- and when it absolutely is not
3. Set up a scratch folder and generate the event stream
4. Build the engine: a naive scorer and a real RBA scorer in one file
5. Watch the naive scorer bury the attacker (the failure mode)
6. Watch RBA lift the attacker to the top and collapse the noise
7. The traps: base rates, score inflation, entity resolution, decay window
8. Doing it for real: Splunk ES RBA, Elastic risk scoring, and detection-as-code

Open the full interactive lab →