SECOPS-PRO · Question #79
A SOC uses Palo Alto Networks Cortex XDR for endpoint detection and response. A new custom behavioral threat detection rule is implemented to identify suspicious PowerShell activity, specifically focu
The correct answer is C. This is a False Positive epidemic. The strategic adjustment should involve refining the custom. This scenario clearly describes a False Positive epidemic. The custom rule is too broad, leading to many alerts for benign activities. The most effective strategic adjustment (Option C) is to refine the rule. This involves adding more specific exclusion criteria (e.g., allowing P
Question
A SOC uses Palo Alto Networks Cortex XDR for endpoint detection and response. A new custom behavioral threat detection rule is implemented to identify suspicious PowerShell activity, specifically focusing on encoded commands and attempts to disable security features. Days after deployment, the SOC is inundated with alerts, most of which are traced back to legitimate IT administration scripts or software installers. This flood of alerts significantly impacts the team's ability to respond to actual threats. Which of the following statements accurately describes this situation and the most effective strategic adjustment?
Options
- AThis is a True Negative scenario; the rule is working as intended. The SOC needs to hire more
- BThis represents a False Negative; the rule is failing to catch true threats. The rule needs to be
- CThis is a False Positive epidemic. The strategic adjustment should involve refining the custom
- DThis is a True Positive overload; genuine threats are being detected. The solution is to automate
- EThis is an example of an 'undetected' event. The rule should be immediately disabled until it can
How the community answered
(44 responses)- A14% (6)
- B2% (1)
- C77% (34)
- D2% (1)
- E5% (2)
Explanation
This scenario clearly describes a False Positive epidemic. The custom rule is too broad, leading to many alerts for benign activities. The most effective strategic adjustment (Option C) is to refine the rule. This involves adding more specific exclusion criteria (e.g., allowing PowerShell scripts signed by trusted vendors, or from specific IT automation directories), incorporating contextual information to differentiate benign from malicious (e.g., PowerShell running in a privileged context versus a user context, or attempts to disable security features only when associated with known malicious indicators), and potentially building a baseline of normal PowerShell behavior to identify Option A and B misclassify the situation. Option D suggests automating responses, which is dangerous with a high False Positive rate. Option E is an overreaction; disabling the rule entirely creates a False Negative risk, instead of
Topics
Community Discussion
No community discussion yet for this question.