Lesson 12: Explain incident Response and Monitoring
Concepts questions with accurate answers
"single pane of glass" Ans✓✓✓SIEM software can offer a ____ view of
all network hosts and appliances by collecting and aggregating logs from
multiple sources. Logs can be collected via an agent running on each
host, or by using syslog (or similar) to forward event data.
/var/log/messages or /var/log/syslog stores all events generated by the
system. Some of these are copied to individual log files.
/var/log/auth.log (Debian/Ubuntu) or /var/log/secure
(RedHat/CentOS/Fedora) records login attempts, use of sudo privileges,
and other authentication and authorization data. Additionally, the faillog
specifically tracks failed login events. Some distros use wtmp, utmp, and
btmp files for use with commands such as w, who, and last to identify
sessions and failed logins.
The package manager log (apt, yum, or dnf, depending on the distro)
stores information about what software has been installed and updated.
Ans✓✓✓Some of the principal log files are as follows:
A cryptographic hash of the disk media is made, using either the MD5 or
SHA hashing function.
A bit-by-bit copy of the media is made using an imaging utility.
,A second hash is then made of the image, which should match the
original hash of the media.
A copy is made of the reference image, validated again by the
checksum. Analysis is performed on the copy.
(This proof of integrity ensures non-repudiation. If the provenance of the
evidence is certain, the threat actor identified by analysis of the evidence
cannot deny their actions. The hashes prove that no modification has
been made to the image.) Ans✓✓✓Once the target disk has been safely
attached to the forensics workstation, data acquisition proceeds as
follows:
a genuine incident has been identified and what level of priority it
should be assigned Ans✓✓✓After the detection process reports one or
more indicators, in the analysis process, the first responder investigates
the data to determine whether _____. Conversely, the report might be
categorized as a false positive and dismissed.
A parser parses log data into a standard format so that it can be recorded
in the SIEM to be correlated Ans✓✓✓Your company has implemented
a SIEM but found that there is no parser for logs generated by the
network's UTM gateway. Why is a parser necessary?
A SIEM collector receives log data from a remote host and parses it into
a standard format that can be recorded within the SIEM and interpreted
for event correlation. A sensor (sniffer) copies data frames from the
network, using either a mirror port on a switch or some type of media
,tap. Ans✓✓✓What is the difference between a sensor and a collector,
in the context of SIEM?
A switch log might reveal an endpoint trying to use multiple MAC
addresses to perpetrate an on-path attack.
A firewall log might identify scanning activity on a blocked port.
An access point log could record disassociation events that indicate a
threat actor trying to attack the wireless network. Ans✓✓✓For
example, network appliance access logs might reveal the following types
of threat:
Acquisition Ans✓✓✓is the process of obtaining a forensically clean
copy of data from a device seized as evidence. If the computer system or
device is not owned by the organization, there is the question of whether
search or seizure is legally valid. This impacts bring-your-own-device
(BYOD) policies. For example, if an employee is accused of fraud, you
must verify that the employee's equipment and data can be legally seized
and searched. Any mistake may make evidence gained from the search
inadmissible.
Action on Objectives Ans✓✓✓The adversary uses the compromised
system to achieve or progress towards goals, such as data exfiltration,
DoS/vandalism, or escalating access across the target network or other
connected networks.
, Advisories and bulletins that warn of new threat types Ans✓✓✓threat
hunting is a labor-intensive activity and so needs to be performed with
clear goals and resources. Threat hunting usually proceeds according to
some hypothesis of possible threat. Security bulletins and advisories
from vendors and security researchers about new TTPs and/or
vulnerabilities may be the trigger for establishing a threat hunt. For
example, if threat intelligence reveals that Windows desktops in many
companies are being infected with a new type of malware that is not
being blocked by any current malware definitions, you might initiate a
threat-hunting plan to detect whether the malware is also infecting your
systems.
Advisories and bulletins that warn of new threat types, Intelligence
fusion and threat data, Maneuver Ans✓✓✓A threat hunting project is
likely to be led by senior security analysts, but some general points to
observe include the following:
Agent-based Ans✓✓✓this approach means installing an agent service
on each host. As events occur on the host, logging data is filtered,
aggregated, and normalized at the host, then sent to the SIEM server for
analysis and storage. Collection from Windows/Linux/macOS
computers will tend to use agent-based collection. The agent must run as
a process and could use from 50-500 MB of RAM, depending on the
amount of activity and processing it does.
Agent-based, Listener/collector, Sensor Ans✓✓✓Collection is the
means by which the SIEM ingests security event data from various
sources. There are three main types of security data collection:
Concepts questions with accurate answers
"single pane of glass" Ans✓✓✓SIEM software can offer a ____ view of
all network hosts and appliances by collecting and aggregating logs from
multiple sources. Logs can be collected via an agent running on each
host, or by using syslog (or similar) to forward event data.
/var/log/messages or /var/log/syslog stores all events generated by the
system. Some of these are copied to individual log files.
/var/log/auth.log (Debian/Ubuntu) or /var/log/secure
(RedHat/CentOS/Fedora) records login attempts, use of sudo privileges,
and other authentication and authorization data. Additionally, the faillog
specifically tracks failed login events. Some distros use wtmp, utmp, and
btmp files for use with commands such as w, who, and last to identify
sessions and failed logins.
The package manager log (apt, yum, or dnf, depending on the distro)
stores information about what software has been installed and updated.
Ans✓✓✓Some of the principal log files are as follows:
A cryptographic hash of the disk media is made, using either the MD5 or
SHA hashing function.
A bit-by-bit copy of the media is made using an imaging utility.
,A second hash is then made of the image, which should match the
original hash of the media.
A copy is made of the reference image, validated again by the
checksum. Analysis is performed on the copy.
(This proof of integrity ensures non-repudiation. If the provenance of the
evidence is certain, the threat actor identified by analysis of the evidence
cannot deny their actions. The hashes prove that no modification has
been made to the image.) Ans✓✓✓Once the target disk has been safely
attached to the forensics workstation, data acquisition proceeds as
follows:
a genuine incident has been identified and what level of priority it
should be assigned Ans✓✓✓After the detection process reports one or
more indicators, in the analysis process, the first responder investigates
the data to determine whether _____. Conversely, the report might be
categorized as a false positive and dismissed.
A parser parses log data into a standard format so that it can be recorded
in the SIEM to be correlated Ans✓✓✓Your company has implemented
a SIEM but found that there is no parser for logs generated by the
network's UTM gateway. Why is a parser necessary?
A SIEM collector receives log data from a remote host and parses it into
a standard format that can be recorded within the SIEM and interpreted
for event correlation. A sensor (sniffer) copies data frames from the
network, using either a mirror port on a switch or some type of media
,tap. Ans✓✓✓What is the difference between a sensor and a collector,
in the context of SIEM?
A switch log might reveal an endpoint trying to use multiple MAC
addresses to perpetrate an on-path attack.
A firewall log might identify scanning activity on a blocked port.
An access point log could record disassociation events that indicate a
threat actor trying to attack the wireless network. Ans✓✓✓For
example, network appliance access logs might reveal the following types
of threat:
Acquisition Ans✓✓✓is the process of obtaining a forensically clean
copy of data from a device seized as evidence. If the computer system or
device is not owned by the organization, there is the question of whether
search or seizure is legally valid. This impacts bring-your-own-device
(BYOD) policies. For example, if an employee is accused of fraud, you
must verify that the employee's equipment and data can be legally seized
and searched. Any mistake may make evidence gained from the search
inadmissible.
Action on Objectives Ans✓✓✓The adversary uses the compromised
system to achieve or progress towards goals, such as data exfiltration,
DoS/vandalism, or escalating access across the target network or other
connected networks.
, Advisories and bulletins that warn of new threat types Ans✓✓✓threat
hunting is a labor-intensive activity and so needs to be performed with
clear goals and resources. Threat hunting usually proceeds according to
some hypothesis of possible threat. Security bulletins and advisories
from vendors and security researchers about new TTPs and/or
vulnerabilities may be the trigger for establishing a threat hunt. For
example, if threat intelligence reveals that Windows desktops in many
companies are being infected with a new type of malware that is not
being blocked by any current malware definitions, you might initiate a
threat-hunting plan to detect whether the malware is also infecting your
systems.
Advisories and bulletins that warn of new threat types, Intelligence
fusion and threat data, Maneuver Ans✓✓✓A threat hunting project is
likely to be led by senior security analysts, but some general points to
observe include the following:
Agent-based Ans✓✓✓this approach means installing an agent service
on each host. As events occur on the host, logging data is filtered,
aggregated, and normalized at the host, then sent to the SIEM server for
analysis and storage. Collection from Windows/Linux/macOS
computers will tend to use agent-based collection. The agent must run as
a process and could use from 50-500 MB of RAM, depending on the
amount of activity and processing it does.
Agent-based, Listener/collector, Sensor Ans✓✓✓Collection is the
means by which the SIEM ingests security event data from various
sources. There are three main types of security data collection:
