CAS-005 · Question #269
An organization has noticed an increase in phishing campaigns utilizing typosquatting. A security analyst needs to enrich the data for commonly used domains against the domains used in phishing…
The correct answer is B. Create a parser that matches domains. To enrich the data for analysis, the security analyst needs to compare the legitimate domains against those used in phishing campaigns. Creating a parser that matches domains allows the SIEM to automatically identify and analyze the domains in the logs, helping detect…
Question
An organization has noticed an increase in phishing campaigns utilizing typosquatting. A security analyst needs to enrich the data for commonly used domains against the domains used in phishing campaigns. The analyst uses a log forwarder to forward network logs to the SIEM. Which of the following would allow the security analyst to perform this analysis?
Options
- AUse a cron job to regularly update and compare domains.
- BCreate a parser that matches domains.
- CDevelop a query that filters out all matching domain names.
- DImplement a dashboard on the SIEM that shows the percentage of traffic by domain.
How the community answered
(18 responses)- A6% (1)
- B83% (15)
- D11% (2)
Explanation
To enrich the data for analysis, the security analyst needs to compare the legitimate domains against those used in phishing campaigns. Creating a parser that matches domains allows the SIEM to automatically identify and analyze the domains in the logs, helping detect typosquatting and other malicious domain usage. This method allows for efficient and automated processing of log data to identify potential threats.
Community Discussion
No community discussion yet for this question.