CCNA Incident Detection And Triage Questions

A parser reads raw log events and extracts individual fields, mapping vendor-specific formats into a common schema so downstream correlation and search work consistently. This normalisation satisfies the SIEM's need for comparable, structured event data across heterogeneous sources.

Recording the exception in the rule's documentation preserves the detection logic while preventing analysts from re-investigating the same benign administrator activity. This satisfies the requirement to document the false positive at source, giving future reviewers the context needed to tune or whitelist the rule without disabling it.

Multiple rapid failures followed by success align with automated password guessing or credential stuffing, which warrants deeper investigation before closure. The analyst should check the source IP, geolocation, and whether the account normally connects from that location. Classifying as suspicious true positive keeps the incident open for enrichment while acknowledging the alert fired on real, relevant activity.

Reviewing the user's recent login history and accessed files helps establish whether the access is anomalous or part of a pattern. This contextual information is essential to determine if the activity is malicious or benign, such as a legitimate cross-departmental project. It is a foundational triage step for insider threat investigations.

Threat intelligence feeds ingest structured indicators such as malicious IPs directly into the SIEM, while lookup tables enrich events by matching those addresses during correlation. Both satisfy the requirement to import and reference an external IP list, unlike static correlation rules or dashboards, which cannot store or refresh indicator data.

The first step in triage is to validate the alert by examining the script's content, parent process, and user context to determine if it is a true positive. This helps avoid unnecessary escalation and ensures that subsequent actions are based on accurate information. Only after validation should containment or evidence collection proceed.

Search cost scales with scanned data volume, so constraining the query to a narrow time range and only the indexes holding relevant events cuts the records processed. This directly addresses the slowness without altering detection logic or losing required events.

This is the most likely explanation. The backup job running at an unexpected time, using a service account with database access, and transferring a large amount of data to an external IP are classic indicators of credential compromise and data exfiltration. Attackers often use legitimate service accounts to blend in. The analyst should investigate the service account's recent activity and the external IP.

Affected system count indicates blast radius: an alert spanning many hosts signals lateral movement or worm-like propagation, demanding immediate escalation. This scope metric lets analysts rank alerts by potential spread, directly satisfying the stem's prioritisation criterion.

The malicious hash confirms the email is genuinely harmful, but the user's claim of non-execution must be validated through endpoint telemetry. Checking for other recipients identifies additional potential victims of the same campaign. This outcome balances accurate classification with the investigative steps needed to confirm scope.

The combination of a hidden, encoded PowerShell command spawned by Microsoft Word is a strong indicator of a malicious macro-based infection, often leading to code execution and further compromise. Isolating the host is the priority to prevent lateral movement and data exfiltration. This aligns with containment best practices in incident response, as the threat is active and potentially spreading.

Harmless-looking payloads may still indicate probing or encoding tricks, so the analyst must verify impact rather than dismiss the alert. Reviewing destination server logs confirms whether the SQL injection actually executed or was blocked, guiding escalation.

Baseline behavioural profiling establishes normal activity patterns per user and entity, so correlation rules can flag genuine deviations rather than static threshold breaches. This satisfies the stem's goal of minimising false positives by tuning detections to observed behaviour.

The where operator filters tabular data by a boolean predicate, letting the analyst restrict SecurityAlert rows to Severity == 'High' and the matching resource provider. It satisfies the requirement to narrow results by severity and originating provider within a single query.

Building Blocks are reusable rule components holding shared test logic, so one definition can be referenced by many correlation rules. This satisfies the tuning requirement to avoid duplicating identical conditions across rules, simplifying maintenance when detection logic changes.

Opening the attachment in a sandbox allows safe dynamic analysis of its behavior, such as file system changes, network connections, and process creation. This is crucial for detecting zero-day or obfuscated malware that may not have a known hash. Sandboxing is a best practice for analyzing potentially malicious files without risking the production environment.

User identity and department information are directory-sourced attributes describing who performed the action. Enrichment correlates an alert's raw account identifier with organisational context, letting analysts judge whether the activity fits that person's normal role and access.

The correlation engine applies rules and logic to normalised events from multiple sources, detecting patterns and triggering alerts in real time. It is the SIEM component that turns raw log streams into actionable security incidents.

Use case design depends on whether the required log sources exist and are reliable, since detection logic cannot function on missing or malformed events. Data availability and quality therefore determine feasibility before rule authoring begins.

Checking the CMDB's Business Criticality and Owner fields establishes whether the 50GB transfer to a known cloud storage IP is sanctioned backup activity, satisfying triage's need to validate intent before escalation. Asset context distinguishes routine scheduled replication from genuine exfiltration, letting analysts prioritise response accurately rather than treating every large transfer as malicious.

A SIEM aggregates and correlates logs from firewalls, endpoints, identity and cloud sources into one platform, giving analysts a single pane across otherwise siloed layers. That consolidation is the core advantage over per-tool monitoring, satisfying the stem's centralisation requirement.

A log source is any device or application that emits security-relevant events, such as firewalls, servers, or identity systems, which the SIEM collects and normalises. This definition satisfies the scenario's requirement to identify what feeds event data into the platform.

A false positive is a benign event misclassified as an attack, so the rate measures legitimate activity flagged as malicious. This directly satisfies the stem's request for what the metric indicates, distinguishing it from false negatives, which measure missed genuine threats.

Excluding the scanner's IP and its known vulnerability signatures suppresses only those noisy detections while the SIEM continues logging and correlating all other activity from that host, preserving visibility without disabling monitoring of the scanner entirely.

A static 500MB threshold ignores normal variation, so legitimate bulk transfers trigger noise. Baselining typical traffic volume per host or user and alerting on statistical deviation satisfies the accuracy requirement by flagging only genuinely anomalous exfiltration-sized transfers.

Attackers often create services to maintain persistence, especially with binaries in non-standard locations like Temp and running with high privileges such as LocalSystem. The recent creation time and lack of change management approval further support malicious activity. This is a common technique mapped to MITRE ATT&CK's Create or Modify System Process: Windows Service (T1543.003).

This is the correct triage step. The analyst must validate whether the alert is a true positive by enriching the source IP with threat intelligence (e.g., known malicious IPs) and examining the account's normal behavior. If the IP is external and the logon is unusual, it indicates a successful compromise. This evidence-based approach ensures appropriate prioritization and response.

Raising the failed-attempt threshold within the lookback window means the correlation search only fires once genuinely abnormal volumes occur, filtering out the low-count bursts that generate the false positives while preserving detection of real brute-force activity.

Dashboards aggregate and render correlated event data as charts, tables and timelines. This visualisation lets analysts monitor trends, spot anomalies and track security posture over time, rather than reviewing individual raw log entries in isolation.

Checking whether the firewall allowed or blocked the outbound connection establishes whether the threat is real or already contained, which determines the urgency and direction of the remaining triage. This verification precedes host isolation or escalation, since a blocked connection requires no containment action.

Automated playbooks execute predefined response actions—isolating endpoints, disabling accounts, blocking indicators—directly from SIEM alerts, satisfying the stem's demand for effective incident response. They cut containment time from hours to seconds, ensuring consistent, repeatable handling of detected threats without waiting for manual analyst intervention.

A known malicious IP address is observable evidence that a system or network has been breached or targeted, which is exactly what an Indicator of Compromise represents. It is artefact-based and can be matched against logs or traffic, unlike a vulnerability or a control weakness.

The lookback window sets how far back the correlation engine examines events when evaluating a rule, so related activity spread across time is grouped. It bounds the temporal scope of analysis, preventing unrelated older events from triggering the rule.

Reviewing the user's file access history helps establish a baseline and identify anomalies. If the user has never accessed this file share before or is accessing an unusual volume of files, it increases suspicion. This action provides valuable context for triage, allowing the analyst to determine if the behavior is consistent with the user's role or indicative of malicious intent.

The time window must match realistic attack velocity: too long dilutes the attempt rate below threshold, too short misses slower attacks. Calibrating it against observed attempts per second ensures the rule fires on genuine brute force rather than normal authentication noise.

Escalation is warranted when analysis confirms genuine malicious activity or unauthorised access, since that demands incident response beyond triage. Confirmed intent or access distinguishes a real breach from benign anomalies that can be closed at tier one.

Determining the business impact of the affected asset establishes how critical the system is to operations, data sensitivity, and revenue. This severity assessment is a core triage step, guiding prioritisation and escalation decisions during alert investigation.

Syslog is the standard event transport for forwarding device and server logs to a SIEM collector, typically over UDP or TCP port 514, making it the common ingestion protocol for firewalls, routers and Unix hosts.

The process tree and command line reveal the parent process and the exact DLL path, which are essential to determine whether this is a known software updater or a malicious loader. Rundll32 is frequently abused to execute DLLs, so the arguments distinguish legitimate use from an attacker's export function call. This evidence drives all subsequent triage decisions.

Searching email gateway logs for the sender address and subject line is an effective way to find other recipients of the same phishing email. This helps identify the scope of the attack and potential additional victims. It is a standard triage step to determine if the phishing campaign was targeted or widespread.

Isolating the workstation is the first containment step to prevent further communication with the malicious IP and potential lateral movement. This action stops the immediate threat while allowing the analyst to investigate. It is a standard incident response procedure for suspected malware or command-and-control communication. Once isolated, the analyst can safely perform forensic analysis and remediation.

Excluding the scanner's IP stops its benign traffic from generating alerts, removing the false positives without weakening detection of genuine threats. Tuning the rule this way is the standard approach for known, trusted internal sources.

Firewall logs are a standard SIEM source, capturing permitted and denied traffic with source and destination IP addresses, ports and protocol. Ingesting them satisfies the stem's requirement for a recognised log type, enabling correlation of network events with other telemetry for threat detection and incident investigation.

Requirement gathering and scoping comes first, defining the threat scenarios, log sources and detection logic before any data onboarding or rule authoring. Skipping it produces use cases misaligned with business risk, so it anchors the SIEM development lifecycle.

Checking the reputation of the destination IP is a quick and effective first step to assess whether the transfer is likely malicious. If the IP is associated with known malicious activity, it strongly indicates a true positive. This action provides immediate context without disrupting operations, and it can be done rapidly using integrated threat intelligence in the SIEM.

Replaying the rule against historical log data validates that it fires as intended and surfaces false positives before production deployment. This satisfies the development process requirement by proving detection logic and tuning thresholds prior to operational rollout.

Ten failures within one second far exceeds human typing speed, indicating a script, brute-force tool, or misconfigured service repeatedly retrying credentials. This rapid, uniform burst is the signature of automation rather than a user mistyping a password.

The log collector receives and normalises event data from disparate sources such as firewalls, servers and applications, forwarding parsed events to the analytics tier. Without this ingestion component, the SIEM has no raw telemetry to correlate, making it a primary architectural element.

Contacting the user directly verifies whether the unusual-location login is legitimate travel or an account compromise, satisfying the need to validate the alert before escalation. User confirmation provides authoritative context that geolocation and IP reputation alone cannot, letting you dismiss a false positive or trigger incident response appropriately.

Categorising alerts by MITRE ATT&CK technique and prioritising them is triage: assessing, enriching and ranking detections to filter noise before deeper investigation. This phase directly reduces alert fatigue by focusing analyst effort on the highest-risk events.

A correlation rule joining user and location attributes detects the same account authenticating from geographically distant sources within one window, flagging impossible travel. This directly satisfies the stem's simultaneous multi-location constraint, which single-event log review cannot surface. Microsoft Entra ID sign-in logs supply the location fields the rule aggregates.

Events parse but map to no QID, so QRadar cannot correlate them into offenses. Creating a custom DSM that maps the event IDs to existing QIDs restores normalisation, enabling the log source to contribute to offense creation as required.

ArcSight correlation rules can only aggregate on fields present in the normalised event schema. If SessionID is absent from the parsed CEF output, the connector or FlexConnector map must first be amended to extract it, satisfying the stem's prerequisite before any rule referencing that field can function.

Deleting volume shadow copies is a hallmark pre-encryption action used by ransomware such as Ryuk and Conti, so treating it as a high-severity incident and isolating the host prevents further spread while preserving the ability to investigate. Isolation before escalation is standard containment practice because the threat is still active and the user is online.

Normalisation parses each vendor's proprietary log schema into a shared field structure, such as common timestamps, source IPs and event types. This lets the SIEM correlate events across heterogeneous sources, which raw vendor-specific formats cannot support directly.

DNS logs show whether the phishing domain was resolved by internal hosts and can reveal command-and-control beaconing to related infrastructure. This helps confirm execution and identify additional compromised systems. Correlating DNS activity with the initial email alerts provides evidence of post-click behavior and helps scope the incident beyond the original recipients.

Password spraying from a compromised internal host produces exactly this pattern: many distinct usernames, a single source, and failures distributed across workstations. Because the server lacks a legitimate authentication role, its authentication traffic is anomalous. This strongly suggests the host is being used as a pivot point for credential attacks, requiring immediate containment and investigation.

Correlation rules evaluate events within a defined aggregation window; if that window is too short or misaligned, matching events never co-occur in the same evaluation cycle, so the rule cannot fire even though the filter logic itself is correct.

Raising thresholds means low-severity events no longer trigger alerts, directly cutting the volume of notifications analysts must triage. This satisfies the stem's goal of reducing alert volume without disabling detection entirely, though it risks missing genuine activity below the new threshold.

Event correlation aggregates and links discrete log entries from multiple sources into a single related incident, revealing patterns that isolated events hide. This satisfies the SIEM requirement to identify security threats by connecting causally or temporally related activity rather than alerting on each event alone.

Source IP, destination host and involved user account supply the correlation triad needed to scope a high-severity alert: attacker origin, targeted asset and compromised identity. This satisfies the stem's initial-triage constraint by enabling rapid containment decisions and pivoting to related telemetry in Microsoft Entra ID sign-in logs before deeper forensic analysis.

Alert scheduling defines the exact time windows during which a correlation rule evaluates events, so restricting evaluation to business hours directly satisfies the stem's timing constraint. Suppression settings complement this by muting notifications outside those windows, preventing after-hours triggers without disabling the underlying detection logic entirely.

Correlation rules match loosely defined patterns across heterogeneous log sources, so benign activity frequently triggers alerts. Tuning thresholds and exceptions becomes a continuous effort, and the resulting high false-positive rate is a defining challenge of SIEM correlation rule development.

A cloud-provider source IP is not inherently malicious, so reputation must be established before classifying. Querying threat intelligence feeds determines whether that address is flagged, supplying the evidence needed to decide if the brute force alert is genuine or benign.

Event correlation logic applies rules that match multiple related log entries across sources and time windows, then merges them into one incident, satisfying the stem's grouping requirement. Unlike simple aggregation, it evaluates conditional relationships between events, so causally linked alerts become a single actionable case rather than separate notifications.

With the agent running and connectivity verified, the failure lies within ingestion. Checking SIEM ingestion error logs reveals agent authentication failures, such as expired certificates or incorrect shared secrets, which silently block log delivery from the Windows server.

Validating the offense against its contributing events establishes scope and truth before any containment or escalation. Confirming the source IP, targeted account, and whether the successful authentication came from a known host distinguishes a true positive from a false positive. This evidence-driven first step prevents premature escalation and ensures subsequent actions are justified by the actual event data.

A SIEM collector receives raw event data from sources such as syslog, agents, or APIs and forwards it to the central processing engine for parsing, correlation, and storage. It handles ingestion and transport, not analysis itself.

Unsigned processes executing from user-writable temp directories and accessing lsass.exe memory match the behavioral pattern of credential dumping tools such as Mimikatz loaders. This combination of unsigned binary, suspicious path, and sensitive process access elevates the alert because it indicates an active attempt to harvest credentials, which is a high-impact threat requiring immediate investigation.

Polling pulls events from the API at fixed intervals, so a long interval delays collection and therefore alert generation. Lowering the polling interval reduces that lag, directly addressing the high latency described in the stem.

Threat intelligence feeds enrich incoming events with indicators such as malicious IPs, domains and hashes, so alerts carry immediate context about known adversary infrastructure. This reduces triage time and improves prioritisation, which is the primary benefit sought from SIEM integration.

Determining the process, user, and parent process identifies whether the scan is from an authorized tool, a scheduled vulnerability scan, or malicious code. This context is the most direct way to classify the activity as benign or malicious. It also guides containment, such as terminating a malicious process or excluding a legitimate scanner from future alerts.

Joins correlate records across SecurityEvent and SigninLogs by matching a shared field, such as account or IP address, which is essential for linking authentication activity to endpoint events during lateral movement. A union merely stacks rows from both tables without relating them, so it cannot satisfy the requirement to correlate the two datasets.

Risk-Based Alerting aggregates many low-fidelity detections into risk scores per entity, so isolated events do not each raise an alert. Only accumulated risk crossing a threshold triggers investigation, which suppresses the noisy single-event false positives the stem targets.

Asset criticality maps each alert to the business value of the affected system, so triage effort follows potential impact rather than raw severity or volume. It directly satisfies the stem's requirement to prioritise on business impact.