John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic…

Question

Options

• ADHCP/Logs capable of maintaining IP addresses or hostnames with IPtoName resolution.
• BIIS/Web Server logs with IP addresses and user agent IPtouseragent resolution.
• CDNS/ Web Server logs with IP addresses.
• DApache/ Web Server logs with IP addresses and Host Name.

• A
  83% (25)
• B
  3% (1)
• C
  10% (3)
• D
  3% (1)

Explanation

To monitor and visualize Tor traffic hitting the network, John would need data sources that can provide detailed information about the source IP addresses of incoming traffic, as well as the capability to resolve these IP addresses to more identifiable information such as hostnames or geographical locations. DHCP logs, or other log sources capable of maintaining detailed IP address records and facilitating IP-to-Name resolution, would be suitable for this purpose. This data would allow John to create a dashboard in the SIEM system that maps the source IP addresses of Tor traffic to their corresponding locations or identities, providing insights into where the Tor traffic is originating. While web server logs (options B, C, and D) can provide IP addresses, they might not offer the same level of detail or resolution capabilities as DHCP logs or similar network-level logs for this specific use case. "Logging and Log Management: The Authoritative Guide to Understanding the Concepts Surrounding Logging and Log Management" by Anton Chuvakin, Kevin Schmidt, and Chris Phillips. "Tor: The Second-Generation Onion Router" by Roger Dingledine, Nick Mathewson, and Paul

No community discussion yet for this question.