Select Two (Multi-Select) Questions

Reconnaissance

This is a valid phase of the Kill Chain.

Weaponization

This is a valid phase of the Kill Chain.

Exploitation

This is a valid phase of the Kill Chain.

Domain Names

Domains are a primary type of IoC for C2 detection.

IP Addresses

IPs are a primary type of IoC.

File Hashes

Hashes are a primary type of IoC for malware detection.

Enablement of the 'Splunk App for CIS Benchmarks'.

This app provides the logic to compare incoming configuration data against known CIS standards.

Deployment of the Splunk Universal Forwarder on target endpoints.

You must collect the log or configuration data from the endpoint to perform a check.

Notable Events framework.

This framework manages the output of detected threats.

Correlation Searches.

These searches are the primary engine for 'Detecting' anomalies in ES.

Detect

This is a core NIST CSF function.

Protect

This is a core NIST CSF function.

Identify

This is a core NIST CSF function.

Using 'NOT' clauses to exclude known administrative processes

Explicit exclusion is a common method for cleaning results.

Implementing lookup tables to exclude known-good baselines

Lookups are the standard way to filter out authorized noise.

Adjusting the threshold for rarity in the 'rare' command

Threshold tuning is necessary to highlight only significant anomalies.

Windows Security Event ID 4688 (Process Creation)

This tracks what the user runs after authenticating.

Windows System Event ID 7045 (Service Installation)

This is a common persistence and movement technique.

Windows Security Event ID 4624 (Logon)

This tracks the movement of users across systems.

A threshold for notable generation

The threshold determines when risk becomes a notable.

Assignment of a risk score

The score provides the weight to the event.

Identification of a risk object

You must define what is at risk.

Change the notable event status

Updating the status is a key part of incident lifecycle management.

Execute adaptive response actions

Adaptive response actions can be run on events directly from the Incident Review UI.

Contextual Asset and Identity information.

Context turns raw logs into actionable intelligence.

CIM-compliant data normalization.

Normalization is required for ES apps to function.

Properly indexed and parsed log data.

Without data, there is nothing to analyze.

Host/Asset context

Asset context, such as ownership, is added to events.

User identity information

Identity context, such as department, is added to events.

Pretexting

A manipulative social engineering technique.

Phishing

A core social engineering tactic.

The Adaptive Response action must be enabled.

If disabled, the action will not trigger.

Validated credentials for the target system.

Without credentials, the action will be denied.

A properly configured Add-on for the target system.

The Add-on handles the actual communication.

Using the 'lookup' command against a KV Store collection.

Custom lookups are a standard way to join threat intel data.

By configuring feeds in the 'Threat Intelligence Manager'.

This is the native way to bring in threat intel.

Improved focus on behavioral indicators

Helps detect low-and-slow attacks.

Prioritization of threats based on entity risk

Focuses analysts on the most critical entities.

Reduction of alert noise

RBA aggregates multiple small alerts into a single risk score.

Endpoint file activity

Tracks sensitive data access.

VPN authentication logs

Tracks remote access by employees.

Email outbound traffic

Tracks data exfiltration attempts.

Suspicious URL in email body

Malicious links are a core component of phishing.

Unexpected sender domain

Phishing often uses domains mimicking legitimate organizations.

Individual risk event scores

These are the base values that get added together.

The aggregation method (sum, average, max)

The method determines how the scores are combined.

Investigation metadata (status, owner)

Metadata keeps track of case state and assignment.

Analyst comments and notes

Comments allow for documenting findings.

Notable events associated with the case

Cases link related notable events together.

Risk Message

You provide a descriptive message for the risk event.

Risk Score

You must define the weight assigned to the event.

Risk Object

You must define which entity is being scored.