What is the first step in determining attack tactics, techniques, and procedures using logs?

Question

Options

• AIdentifying unusual outbound traffic
• BAnalyzing login attempts
• CReviewing the timestamp of entries
• DCorrelating events across different log sources

• A
  1% (1)
• B
  1% (1)
• C
  3% (2)
• D
  94% (65)

Explanation

Correlating events across different log sources (D) is the essential first step because attack TTPs rarely manifest in a single log - they leave traces across firewalls, authentication systems, endpoints, and network devices, and only by correlating these can you reconstruct the full attack chain and identify the technique being used. Identifying unusual outbound traffic (A) is a valuable detection activity, but it's a specific thing you look for after correlation, not a starting methodology. Analyzing login attempts (B) is similarly a targeted investigation of one log type, not a holistic first step. Reviewing timestamps (C) is a supporting action you perform during correlation to establish sequence, not a standalone first step that reveals TTPs.

Memory tip: Think "connect the dots first" - TTPs are patterns that span systems, so you must correlate before you can conclude. No single log tells the whole story.

No community discussion yet for this question.