nerdexam
GIAC

GCIH · Question #791

Which of the following is shown in the screenshot?

The correct answer is D. RITA anomaly analysis. RITA (Real Intelligence Threat Analytics) is an open-source tool that analyzes network logs to detect anomalous patterns such as beaconing and command-and-control traffic.

Incident Response & Cyber Kill Chain

Question

Which of the following is shown in the screenshot?

Exhibit

GCIH question #791 exhibit

Options

  • ADAIR scoping response
  • BATT&CK discovery techniques
  • COSINT data collection
  • DRITA anomaly analysis

How the community answered

(25 responses)
  • A
    4% (1)
  • C
    4% (1)
  • D
    92% (23)

Why each option

RITA (Real Intelligence Threat Analytics) is an open-source tool that analyzes network logs to detect anomalous patterns such as beaconing and command-and-control traffic.

ADAIR scoping response

DAIR scoping response refers to a methodology for defining the scope of an incident response engagement, not a network traffic anomaly analysis tool output.

BATT&CK discovery techniques

ATT&CK discovery techniques are entries in the MITRE ATT&CK framework taxonomy describing adversary behaviors, not a visual tool output.

COSINT data collection

OSINT data collection involves gathering information from publicly available external sources, not analyzing internal network traffic logs for anomalies.

DRITA anomaly analysisCorrect

RITA is a framework developed by Active Countermeasures that ingests Zeek network logs and applies statistical analysis to surface anomalies like beaconing, DNS tunneling, and long-duration connections. Its output displays scored connection data with fields such as beacon scores, connection counts, and destination hosts that are characteristic of the RITA interface. This type of anomaly analysis view is distinct from raw packet capture or framework taxonomy displays.

Concept tested: RITA network anomaly and beaconing detection

Source: https://www.activecountermeasures.com/free-tools/rita/

Topics

#RITA#anomaly detection#network traffic analysis#threat hunting

Community Discussion

No community discussion yet for this question.

Full GCIH Practice