How can logs help in identifying the tactics, techniques, and procedures of a threat actor?

Question

Options

• ABy showing the time of day attacks are most likely to occur
• BBy revealing patterns and anomalies that indicate malicious activity
• CBy indicating the level of user satisfaction with IT services
• DBy tracking the number of successful phishing attempts

• A
  2% (1)
• B
  91% (43)
• C
  2% (1)
• D
  4% (2)

Explanation

Logs capture detailed records of system events, network traffic, user actions, and application behavior - making them invaluable for identifying the patterns and anomalies that define how a threat actor operates (their TTPs). For example, repeated failed logins followed by a successful one, lateral movement between systems, or unusual data exfiltration all show up as log anomalies that map directly to MITRE ATT&CK techniques.

Why the distractors are wrong:

• A is misleading - while logs do include timestamps, "time of day" alone is not a TTP indicator and isn't the primary value of log analysis.
• C is entirely off-scope - user satisfaction belongs to service management (ITSM), not threat detection.
• D is too narrow - phishing counts represent one specific metric, whereas logs expose the full breadth of attacker behavior across the kill chain.

Memory tip: Think of logs as a crime scene timeline - they don't just tell you when something happened, they reveal how the attacker moved, what tools they used, and what they were after. That "how" = TTPs.

No community discussion yet for this question.