GCIH · Question #791
Which of the following is shown in the screenshot?
The correct answer is D. RITA anomaly analysis. RITA (Real Intelligence Threat Analytics) is an open-source tool that analyzes network logs to detect anomalous patterns such as beaconing and command-and-control traffic.
Question
Which of the following is shown in the screenshot?
Exhibit
Options
- ADAIR scoping response
- BATT&CK discovery techniques
- COSINT data collection
- DRITA anomaly analysis
How the community answered
(25 responses)- A4% (1)
- C4% (1)
- D92% (23)
Why each option
RITA (Real Intelligence Threat Analytics) is an open-source tool that analyzes network logs to detect anomalous patterns such as beaconing and command-and-control traffic.
DAIR scoping response refers to a methodology for defining the scope of an incident response engagement, not a network traffic anomaly analysis tool output.
ATT&CK discovery techniques are entries in the MITRE ATT&CK framework taxonomy describing adversary behaviors, not a visual tool output.
OSINT data collection involves gathering information from publicly available external sources, not analyzing internal network traffic logs for anomalies.
RITA is a framework developed by Active Countermeasures that ingests Zeek network logs and applies statistical analysis to surface anomalies like beaconing, DNS tunneling, and long-duration connections. Its output displays scored connection data with fields such as beacon scores, connection counts, and destination hosts that are characteristic of the RITA interface. This type of anomaly analysis view is distinct from raw packet capture or framework taxonomy displays.
Concept tested: RITA network anomaly and beaconing detection
Source: https://www.activecountermeasures.com/free-tools/rita/
Topics
Community Discussion
No community discussion yet for this question.
