CAS-005 · Question #246
A security engineer wants to stay up-to-date on new detections that are released on a regular basis. The engineer's organization uses multiple tools rather than one specific vendor security stack…
The correct answer is A. Sigma. Sigma is a rule-based detection language that is vendor-agnostic, meaning it can be used across different SIEM (Security Information and Event Management) tools.
Question
A security engineer wants to stay up-to-date on new detections that are released on a regular basis. The engineer's organization uses multiple tools rather than one specific vendor security stack. Which of the following rule-based languages is the most appropriate to use as a baseline for detection rules with the multiple security tool setup?
Options
- ASigma
- BYARA
- CSnort
- DRita
How the community answered
(19 responses)- A84% (16)
- B11% (2)
- C5% (1)
Explanation
Sigma is a rule-based detection language that is vendor-agnostic, meaning it can be used across different SIEM (Security Information and Event Management) tools.
Community Discussion
No community discussion yet for this question.