An analyst is investigating a potentially compromised endpoint within the network and pulls a host report for the endpoint in question to collect metrics and documentation. What information should…

The correct answer is D. intrusion events, host connections, and user sessions. The Firepower System correlates various types of data (intrusion events, Security Intelligence, connection events, and file or malware events) to determine whether a host on your monitored network is likely to be compromised by malicious means. Certain combinations and…

Management and Troubleshooting

Question

An analyst is investigating a potentially compromised endpoint within the network and pulls a host report for the endpoint in question to collect metrics and documentation. What information should be taken from this report for the investigation?

Options

Aclient applications by user, web applications, and user connections
Bnumber of attacked machines, sources of the attack, and traffic patterns
Cthreat detections over time and application protocols transferring malware
Dintrusion events, host connections, and user sessions

How the community answered

(38 responses)

A
8% (3)
B
5% (2)
C
3% (1)
D
84% (32)

Explanation

The Firepower System correlates various types of data (intrusion events, Security Intelligence, connection events, and file or malware events) to determine whether a host on your monitored network is likely to be compromised by malicious means. Certain combinations and frequencies of event data trigger indications of compromise (IOC) tags on affected hosts. guide-v64/using_host_profiles.html#ID-2218-000003be

Topics

#Endpoint investigation#Host reports#Incident response#Security monitoring

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice