We used to use this great strategy, which gave us proper insight as well as provided us with the learning curve toward the overall incident-response program.
The manager used to decide any random production system, which will act like a test bait to test whether things are working as expected. The SOC team was not aware of anything.
A few random servers used to be taken, a critical system file used to be modified, and after logging out the start time was calculated.
In an ideal scenario, when a critical system file is modified, there will be an OSSEC alert, which will be sent over to the email of the SOC team. In response to that, the SOC member will check what was modified and on which server. He will then check the lastlog to see who logged in last and also check what command the user ran. Once it's verified that the user has modified the file...
