# Wazuh Alert Triage (lab)

> Triage a Monday-morning queue of 1,193 Wazuh alerts across four agents. Most of it is documented noise, but one exempted source has stopped behaving the way its exemption describes.

Canonical: https://codelivly.com/labs/wazuh-triage

| | |
|---|---|
| Type | Investigation |
| Difficulty | Beginner |
| Points | 250 |
| Session length | 30 min |
| Completions | 5 |

Triage a Monday-morning queue of 1,193 Wazuh alerts across four agents. Most of it is documented noise, but one exempted source has stopped behaving the way its exemption describes.

## Objective

You learn to triage a real SOC queue by subtraction: use a tuning baseline to dismiss agreed noise, but verify the conditions of each exemption rather than matching on source alone, and rank findings by impact instead of by alert level.

## Tasks

1. Profile the queue
2. Work the loud end against the baseline
3. Find the exemption that stopped holding
4. Rank what is left by impact
5. Reconstruct the sequence and map it

## Related

- [All labs](https://codelivly.com/practice?type=lab)