nerdexam
Google

PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #55

You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses…

The correct answer is D. not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8"). To reduce false positives from internal IP addresses in the 192.0.2.0/8 subnet, you need to exclude them in the detection rule. The correct syntax is to use not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8"). This ensures that alerts are not triggered for events…

Configuring detections

Question

You are responsible for identifying suspicious activity and security events in your organization's environment. You discover that some detection rules are being triggered for internal IP addresses in the 192.0.2.0/8 subnet that are causing false positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?

Options

  • Anet.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
  • Bnet.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
  • Cnot net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
  • Dnot net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")

How the community answered

(15 responses)
  • B
    7% (1)
  • C
    13% (2)
  • D
    80% (12)

Explanation

To reduce false positives from internal IP addresses in the 192.0.2.0/8 subnet, you need to exclude them in the detection rule. The correct syntax is to use not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8"). This ensures that alerts are not triggered for events originating from internal addresses while still detecting truly suspicious external activity.

Topics

#YARA-L rules#CIDR filtering#false positive reduction#net.ip_in_range_cidr

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice