Incident indicators and alerts in Cybersecurity - Mini Project: Build & Apply

Incident Indicators and Alerts

📖 Scenario: You work in a cybersecurity team monitoring a company's network. Your job is to identify signs of possible security incidents by tracking specific indicators and setting alerts.

🎯 Goal: Build a simple list of incident indicators, configure alert thresholds, and understand how alerts are triggered based on these indicators.

📋 What You'll Learn

Create a list of incident indicators with exact names

Add a threshold value for alert triggering

Write a loop to check indicators against the threshold

Add a final alert message configuration

💡 Why This Matters

🌍 Real World

Security analysts monitor incident indicators to detect and respond to threats quickly.

💼 Career

Understanding how to track and alert on incident indicators is essential for cybersecurity roles like SOC analyst or incident responder.

1

Create a list of incident indicators

Create a list called indicators containing these exact strings: 'Failed Login Attempts', 'Unusual Network Traffic', 'Malware Alerts', 'Unauthorized Access'.

Cybersecurity

# Create the list called indicators with the exact incident indicator names
# Your code here

Need a hint?

Use square brackets to create a list and include the exact strings separated by commas.

2

Set an alert threshold

Create a variable called alert_threshold and set it to the integer 5. This will represent the number of incidents needed to trigger an alert.

Cybersecurity

indicators = ['Failed Login Attempts', 'Unusual Network Traffic', 'Malware Alerts', 'Unauthorized Access']
# Set the alert threshold to 5
# Your code here

Need a hint?

Simply assign the number 5 to the variable alert_threshold.

3

Check indicators against the threshold

Create a dictionary called incident_counts with the same keys as indicators and these exact values: 3, 7, 2, 6. Then write a for loop using variables indicator and count to iterate over incident_counts.items().

Cybersecurity

indicators = ['Failed Login Attempts', 'Unusual Network Traffic', 'Malware Alerts', 'Unauthorized Access']
alert_threshold = 5
# Create incident_counts dictionary and write a for loop to iterate over it
# Your code here

Need a hint?

Create the dictionary with exact keys and values, then write a for loop with the specified variable names.

4

Add alert message configuration

Inside the for loop, add an if statement to check if count is greater than or equal to alert_threshold. If true, create a variable called alert_message and set it to the string "Alert: {indicator} count is {count}, which exceeds the threshold!" using an f-string.

Cybersecurity

indicators = ['Failed Login Attempts', 'Unusual Network Traffic', 'Malware Alerts', 'Unauthorized Access']
alert_threshold = 5
incident_counts = {'Failed Login Attempts': 3, 'Unusual Network Traffic': 7, 'Malware Alerts': 2, 'Unauthorized Access': 6}
for indicator, count in incident_counts.items():
    # Add if statement to check count against alert_threshold
    # Create alert_message with f-string if condition is met
    # Your code here

Need a hint?

Use an if statement to compare count and alert_threshold, then create alert_message using an f-string.