You are a SOC analyst reviewing IDS/IPS alerts from the last hour. Your SIEM has surfaced 6 alerts.
For each alert, classify it as: True Positive (real attack), False Positive (benign activity misflagged),
True Negative (no alert, no attack), or False Negative (real attack, no alert).
Then answer the rule-writing question at the bottom.
🔍 Environment Context
Known Good IPs
10.0.0.5 — Vuln Scanner 10.0.0.10 — Web Server 10.0.0.50 — Backup Agent
Threat Intel
203.0.113.99 — Known C2 198.51.100.42 — Tor exit node Port 4444 — Meterpreter default
DNS queries: <500/hr
Outbound HTTPS: normal 443
SSH: internal only
Classify each alert — use the context above
Alert ID
Time
Signature / Description
Src IP → Dst IP
Severity
Classification
#1001
04:03
Port scan detected — TCP SYN to 1024 ports
10.0.0.5 → 10.0.0.0/24
MEDIUM
#1002
08:41
Outbound connection to known C2 — TCP 443
10.0.0.87 → 203.0.113.99
CRITICAL
#1003
09:15
SQL injection attempt — pattern: OR 1=1
198.51.100.42 → 10.0.0.10
HIGH
#1004
02:04
Large outbound data transfer — 4.2 GB to 10.0.0.50
10.0.0.10 → 10.0.0.50
MEDIUM
#1005
11:30
Meterpreter reverse shell — TCP port 4444
10.0.0.23 → 198.51.100.42
CRITICAL
#1006
13:45
SSH brute-force — 847 failed attempts in 2 min
192.0.2.55 → 10.0.0.10
HIGH
📝 Rule Writing Question
Alert #1005 (Meterpreter on port 4444) was detected but not blocked — the device was configured as an IDS, not IPS.
Which Snort rule would correctly alert AND block outbound TCP connections to port 4444?