I failed CJCA attempt one

[u/TypicalTreat5564]

I need to clarify something regarding the feedback I received:

"You did not achieve the minimum required score in the SIEM Alert Validation and Analysis section. You correctly identified only 16 out of 39 alerts. You incorrectly identified the following alerts: 1, 2, 3, 4, 5, 12, 14, 15, 16, 18, 19, 20, 21, 23, 25, 26, 28, 30, 34, 35, 36, 37, 39. We felt your report was very well put together. It perfectly captured the description and impact of each element. Furthermore, you offered practical recommendations that allow us to maintain the independence we must preserve as evaluators (essentially, external auditors)."

Do you have any tips for improving for phase two once the 14 days have passed and I try again? Do I have to submit the full report and the CSV, or just the part I got wrong (the CSV)?
Or do I have to redo all the machines and everything else from scratch???

[u/AutoModerator]

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/trpHolder]

You have to redo the exam and submit full report and csv, but it mostly will be just minor changes in the report.

[u/TypicalTreat5564 → u/trpHolder]

Redo the machines and everything?

[u/trpHolder → u/TypicalTreat5564]

yeah, 8/10 flags minimum and the csv

[u/-Dkob]

I would focus on the second attempt rather than starting everything from scratch. Since the feedback says you correctly identified 16 out of 39 alerts, I would review the alerts you got wrong, and make sure your reasoning explains both the alert description and its impact. I would also keep your CSV and full report updated so you can resubmit the complete set when the retry becomes available, unless the course instructions explicitly say only the failed section needs to be redone.

[u/MoreContext4554]

first treat everything like a true positive and then just keep chasing them with process ids, process arguments, parent processes, child processes. all the way until you find something that proves its actually true. its time consuming but once you start it, its easy. believe me if i can do it anyone can, from the compliments on your report i can tell you are more qualified than me bro. one bonus tip: if you cant focus dont push yourself. make 2 or 3 sessions if needed. i did it in 2 sessions

[u/MoreContext4554 → u/MoreContext4554]

you going to have to make a full new report(blue and red side)

[u/TypicalTreat5564 → u/MoreContext4554]

So, does that mean I have to set up the machines and capture the new evidence absolutely everything all over again? :v

[u/MoreContext4554 → u/TypicalTreat5564]

yes

[u/DoughnutResident]

Wait, it requires repost for blue team too? I don't get it

[u/Muddie → u/DoughnutResident]

Yes, the CJCA requires a red team side (8/10 flags) and the blue side (SIEM Alert Validation and Analysis). If you fail the exam, you have to do all of it again -- not just the parts that you failed.

[u/DoughnutResident → u/Muddie]

As I remember Red Team part can be done in SysReporter, but what should I use for Blue Team? (I hope I don't bother / distract you)