CS0-003 · Question #624
A company suspects a coordinated effort to attack their platform. Web server logs show malicious activity from many different source IP addresses located in different countries. Which of the following
The correct answer is B. Create a custom SIEM query to integrate threat intel IoCs associated with the threat actor.. By incorporating known indicators of compromise (such as malicious IPs, URLs, or hashes) into a SIEM query, the analyst can quickly filter through disparate log entries and surface only the requests tied to that campaign - regardless of their geographic origin.
Question
A company suspects a coordinated effort to attack their platform. Web server logs show malicious activity from many different source IP addresses located in different countries. Which of the following will best help a security analyst identify the requests connected to this campaign?
Options
- AModify the web server logs to include the X-Forwarded-For header.
- BCreate a custom SIEM query to integrate threat intel IoCs associated with the threat actor.
- CEnrich the web server request logs with full WHOIS data on all available sources.
- DAdd GeoIP location for the source IP addresses to the log entries.
How the community answered
(38 responses)- A3% (1)
- B84% (32)
- C8% (3)
- D5% (2)
Explanation
By incorporating known indicators of compromise (such as malicious IPs, URLs, or hashes) into a SIEM query, the analyst can quickly filter through disparate log entries and surface only the requests tied to that campaign - regardless of their geographic origin.
Topics
Community Discussion
No community discussion yet for this question.