CAS-005 · Question #499
A security architect performs a baseline review on the SIEM. The findings indicate that multiple use cases are missing and coverage is limited for defense evasion techniques. Which of the following…
The correct answer is D. Use Sigma to build the logic of the use cases and testing on the SIEM. Sigma is a vendor-agnostic detection rule format that allows building and testing SIEM use cases efficiently. Using Sigma ensures broader coverage, including defense evasion techniques, and provides a standardized approach for detection logic.
Question
A security architect performs a baseline review on the SIEM. The findings indicate that multiple use cases are missing and coverage is limited for defense evasion techniques. Which of the following processes best describes what the architect should do?
Options
- AImplement a TIP on the internal network to facilitate the creation of a use case.
- BPerform a penetration test on critical devices and document IOCs for use cases.
- CCreate a list of use cases based on Snort detection rules.
- DUse Sigma to build the logic of the use cases and testing on the SIEM.
How the community answered
(26 responses)- A12% (3)
- B8% (2)
- C31% (8)
- D50% (13)
Explanation
Sigma is a vendor-agnostic detection rule format that allows building and testing SIEM use cases efficiently. Using Sigma ensures broader coverage, including defense evasion techniques, and provides a standardized approach for detection logic.
Community Discussion
No community discussion yet for this question.