210-255 · Question #15
What information from HTTP logs can be used to find a threat actor?
The correct answer is B. IP address. The IP address field in HTTP logs is the primary artifact used to attribute requests to a specific source and identify a threat actor. Other HTTP log fields describe request metadata but cannot uniquely identify the requester.
Question
What information from HTTP logs can be used to find a threat actor?
Options
- Areferer
- BIP address
- Cuser-agent
- DURL
How the community answered
(18 responses)- A6% (1)
- B89% (16)
- C6% (1)
Why each option
The IP address field in HTTP logs is the primary artifact used to attribute requests to a specific source and identify a threat actor. Other HTTP log fields describe request metadata but cannot uniquely identify the requester.
The referer field shows the originating URL that linked to a resource and provides navigational context, but it does not identify who made the request.
The source IP address recorded in HTTP logs directly ties a request to a specific host, allowing analysts to correlate the address against threat intelligence feeds, geolocation data, and other logs to attribute activity to a threat actor.
The user-agent field identifies the client software or browser, which is trivially spoofed and cannot reliably or uniquely identify a threat actor.
The URL field identifies which resource was requested on the server, but does not contain information about the identity or location of the requester.
Concept tested: HTTP log field analysis for threat attribution
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf
Topics
Community Discussion
No community discussion yet for this question.