57 questions · Incident Detection And Triage · All types, answers revealed
In a SIEM, what is the role of a 'Parser'?
Parsing creates the structure needed for correlation.
Why this answer
Parsers normalize raw log data into a structured format with defined fields.
You are investigating a SIEM alert and identify a false positive caused by a system administrator's legitimate activity. How should you document this?
Proper documentation prevents repeated false positives.
Why this answer
Updating the rule's documentation ensures future analysts understand why the activity is allowed.
You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?
These features are specifically designed to enrich alerts with external data.
Why this answer
Lookups or Threat Intelligence feeds are the standard ways to import external lists of IoCs.
You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?
Reducing the data set size significantly improves performance.
Why this answer
Filtering by time range and limiting fields are standard practices to optimize SIEM performance.
Which THREE of the following are common attributes used to prioritize security alerts during the triage process?
Scope increases severity and priority.
Why this answer
Business criticality, threat intelligence context, and the number of affected hosts are fundamental metrics for determining the priority of an incident.
An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?
Analyzing the impact confirms the severity of the alert.
Why this answer
Triage involves confirming the intent and success of the attack, not just the signature match.
When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?
Knowing 'normal' helps filter out 'abnormal' noise.
Why this answer
Baseline behavioral profiling and using multiple conditions (cross-correlation) help reduce noise by ensuring that only significant deviations trigger an alert.
You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?
This specifically targets the unique IP count requirement within the QRadar rule engine.
Why this answer
Using a Building Block (BB) allows for reusable logic. Combining a threshold condition with a 'unique count' filter on source IP addresses ensures the rule only fires when the specific cross-IP threshold is met.
A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?
The where operator is the correct filter mechanism in KQL.
Why this answer
The 'where' operator is the standard KQL command for filtering table results based on specific column criteria.
When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?
Building blocks simplify maintenance and rule design.
Why this answer
Building blocks allow you to reuse common logic (e.g., 'Internal IPs') across multiple rules.
Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?
Identity tells you who is involved.
Why this answer
Asset info, threat intel, and user identity add meaning to raw logs.
Which component of a SIEM is responsible for identifying patterns in real-time?
This is the core engine for detection logic.
Why this answer
The correlation engine evaluates incoming events against defined logic to trigger alerts.
Which THREE of the following factors should be considered when designing a new SIEM use case?
Without good data, you cannot detect threats.
Why this answer
Data availability, business risk, and rule complexity are essential considerations.
You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?
Verification against CMDB data is the standard first step in triage to rule out authorized activity.
Why this answer
Validating the legitimacy of the activity is critical. Checking if the user is authorized for cloud backups or if the machine is a known server/backup agent prevents false escalation.
Which of the following is a key advantage of utilizing a centralized SIEM platform?
Centralization provides the holistic view required for detection.
Why this answer
A unified view allows for correlation across disparate security layers, which is impossible with siloed tools.
What is a 'log source' in the context of a SIEM?
Log sources are the data contributors to a SIEM.
Why this answer
Any device or application that generates logs (firewalls, servers, databases) is a log source.
What does the 'False Positive' rate of a SIEM rule indicate?
This is the definition of a false positive.
Why this answer
High false positive rates degrade SOC efficiency and lead to analyst burnout.
You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?
Exclusions allow for surgical tuning while maintaining log ingestion.
Why this answer
Creating a suppression rule or an exclusion filter based on the scanner's IP address and specific signature IDs allows you to silence known noise while keeping the events in the logs for audit purposes.
You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?
Baselines reduce false positives from routine backups or updates.
Why this answer
Baseline behavior provides a reference point, reducing false positives caused by expected high-volume traffic.
You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?
Increasing the threshold effectively filters out noise while still capturing high-volume attacks.
Why this answer
Risk-based alerting and threshold tuning are standard practices to reduce noise in SIEM correlation rules.
What is the purpose of 'Dashboards' in a SIEM?
Visualization is the primary role of dashboards.
Why this answer
Dashboards visualize data to help analysts identify trends and monitor health.
An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?
If blocked, the alert is likely a low-priority 'attempted' event.
Why this answer
Verifying if the connection was successful is essential to confirm if a threat exists.
Which THREE of the following are essential for effective incident response within a SIEM?
Playbooks ensure consistent response.
Why this answer
Documentation, playbooks, and integration are critical for response.
Which of the following is an example of an 'Indicator of Compromise' (IoC)?
IoCs are specific artifacts of an attack.
Why this answer
A malicious IP or file hash is a classic IoC.
What is the purpose of a 'Lookback Window' in a SIEM correlation rule?
The window determines the scope of the correlation logic.
Why this answer
The lookback window defines the timeframe for analyzing historical events to detect a pattern.
You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?
Matching the window to the attack methodology ensures detection.
Why this answer
The time window must be long enough to capture slow-and-low attacks but short enough to avoid excessive false positives.
Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?
Confirmed threats must be handled immediately.
Why this answer
High-impact assets and confirmed malicious activity are primary escalation criteria.
Which THREE of the following are common steps during the 'Alert Triage' process?
Impact dictates the escalation priority.
Why this answer
Triage involves verification, context gathering, and determining impact.
Which of these is a common SIEM data ingestion protocol?
Syslog is the universal standard for log shipping.
Why this answer
Syslog is the most common and standard protocol for log transmission.
You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?
Excluding known assets is the standard way to reduce false positives.
Why this answer
Excluding known-good assets prevents alert fatigue and ensures SOC focus on real threats.
Which TWO of the following are standard log types ingested into a SIEM?
Essential for network traffic analysis.
Why this answer
Firewall and Authentication logs are fundamental security data.
When building a new SIEM use case, what is the first phase of the development lifecycle?
You must understand the business need before building the rule.
Why this answer
Defining requirements is always the starting point for SIEM use case design.
During alert triage, why is it important to check the 'source' of an alert?
Security tools have different confidence levels than custom application logs.
Why this answer
Identifying if the source is a security tool or an application helps determine the reliability of the detection.
Which TWO of the following are key components of a successful SIEM use case development process?
Backtesting validates the rule logic.
Why this answer
Aligning to threat frameworks (like MITRE ATT&CK) and testing against historical data are the pillars of effective use case engineering.
You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?
Human typing cannot produce 10 failures per second.
Why this answer
Rapid-fire failures usually indicate a script or bot, rather than a human user.
Which TWO of the following are primary components of a SIEM architecture?
Collectors ingest data.
Why this answer
Collectors and the central analytics engine are core components.
You are reviewing a SIEM alert and see a 'Successful login' from an unusual location. What is the next logical action?
Direct verification is the most efficient triage step.
Why this answer
Verifying with the user is a quick way to confirm if the login was legitimate.
A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?
Categorizing alerts by technique is a standard triage activity.
Why this answer
Triage and prioritization involve categorizing and assessing the urgency of alerts to focus on the most critical threats.
You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?
Comparing geographic data for a single user is a classic use case.
Why this answer
User Entity Behavior Analytics (UEBA) and correlation rules are designed to detect impossible travel or multiple concurrent logins.
In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?
Correct mapping is required for the correlation engine to interpret the logs.
Why this answer
QID mapping ensures that normalized events are correctly classified for correlation.
You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?
Parsing must occur at the ingest/agent level before the field is available for rule logic.
Why this answer
Before a field can be used in a correlation rule, it must be mapped to a Common Event Format (CEF) field or a custom FlexConnector mapping must be defined to parse it from the raw log.
What is the purpose of normalizing logs in a SIEM?
Normalization is essential for querying multiple data sources uniformly.
Why this answer
Normalization creates a common schema, allowing for cross-vendor correlation.
In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?
If the aggregation window is too small, events may not be counted correctly.
Why this answer
Event aggregation settings can prevent rules from firing if the conditions are too restrictive.
Which TWO of the following are effective methods for reducing alert volume in a SIEM?
Thresholding removes low-confidence events.
Why this answer
Suppression and threshold tuning are primary reduction methods.
Which of the following describes 'Event Correlation' in a SIEM?
Correlation provides the 'story' behind individual events.
Why this answer
Correlation relates disparate events to identify a security threat.
You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?
These are the fundamental entities of any security incident.
Why this answer
Context like the source, destination, and user activity is required to assess risk.
You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?
Scheduling restricts when the rule evaluates data.
Why this answer
Time-based scheduling is a core feature for managing alert relevance in SIEMs.
Which THREE of the following are common challenges in SIEM correlation rule development?
Noise is the biggest challenge in SIEM.
Why this answer
Noise, data quality, and skill requirements are major challenges.
You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?
Context from threat intel is vital for triage.
Why this answer
Cloud-based IPs are often legitimate proxies or malicious botnets; context is key.
Which SIEM feature is used to group related events into a single incident?
Correlation links disparate events into meaningful incidents.
Why this answer
Correlation engines or incident management modules group events based on shared attributes.
You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?
Errors in logs will point to the root cause (e.g., certificate expiry).
Why this answer
Checking the SIEM ingestion logs or agent logs is the logical step to identify why the data is not reaching the SIEM.
What is the primary function of a SIEM collector?
Collectors act as the ingestion point for the SIEM.
Why this answer
Collectors gather data from various sources and forward it to the main processing engine.
When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?
Frequent polling is required for near-real-time alerts.
Why this answer
API polling intervals are the most common source of latency in cloud log ingestion.
What is the primary benefit of 'Threat Intelligence' integration in a SIEM?
Context allows analysts to make informed decisions.
Why this answer
Threat intelligence provides context (IP reputation, malware hashes) to events.
You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?
Joins are essential for correlating disparate data sources.
Why this answer
Joins allow for the association of different data types based on common entities like IP addresses or hostnames.
Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?
RBA aggregates risk, reducing individual alert noise.
Why this answer
Tuning thresholds and using risk-based alerting are key strategies.
When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?
High-value assets require immediate attention regardless of the attack type.
Why this answer
Asset criticality helps determine the priority of an incident in a real-world SOC environment.
Ready to test yourself?
Try a timed practice session using only Incident Detection And Triage questions.