IDLE

Risk-Based Alerting (RBA)

Name: Risk-Based Alerting (RBA)
Brand: Hacker Labs

INSTANCE: hl-attackriskbase · IP: 10.10.25.35 · us-west-2

TIME02:30:00

Ubuntu

Lab not running

Click Launch above to provision a fresh Ubuntu VM. Takes ~30s.

Submit flag

0/4 objectives

Scenario

Convert ATT&CK detections into weighted risk scores and trigger a high-risk alert on user jsmith.

Objectives — click to toggle

Step-by-step walkthrough

1
Install the RBA framework
Enable Splunk ES Risk Analysis and the risk index.
2
Convert 3 detections
Re-emit each detection with risk_object=user, risk_score, risk_message, mitre_attack_id.
3
Set risk weights
Credential Dumping=80, Lateral Movement=50, PowerShell Abuse=40.
4
Aggregation search
Notable fires when risk sum > 100 in 24h for any single risk_object.
5
Validate
Replay the ShadowFox dataset → notable for user jsmith with risk=170.

Submission requirements

Upload deliverables via the Files tab before claiming points.