What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

The correct answer is D. User Search. User Search is a search page that allows a threat hunter to search for user activity across endpoints and correlate it with other events. This can help differentiate testing, DevOPs, or general user activity from adversary behavior by identifying anomalous or suspicious user…

Threat Hunting and Investigation

Question

Options

AHash Search
BIP Search
CDomain Search
DUser Search

How the community answered

(43 responses)

A
2% (1)
B
5% (2)
C
9% (4)
D
84% (36)

Explanation

User Search is a search page that allows a threat hunter to search for user activity across endpoints and correlate it with other events. This can help differentiate testing, DevOPs, or general user activity from adversary behavior by identifying anomalous or suspicious user actions, such as logging into multiple systems, running unusual commands, or accessing sensitive files.

Topics

#User Search#threat hunting#adversary differentiation#DevOps activity

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice