4.3 Incident Investigation

Question 1

Vulnerability scans

Answer 1

1. Uses database of known vulnerabilities to scan systems based on a signature
2. Run on systems to ensure that they are properly configured and hardened

Question 2

Security Information and Event Management (SIEM) (2)

Answer 2

1. Consolidates logs from multiple systems for analysis
2. Has logic to find correlations in the data to help identify potential breaches

Question 3

Define sensor relative to SIEM

Answer 3

Can provide network traffic data to SIEM in a standardized format

Question 4

Define SIEM alerts

Answer 4

Capability of SIEM to analyze data and provide alerts based on this

Question 5

Define syslog

Answer 5

A standard utility for transferring log files from a device to a central location, works across many different OS

Question 6

Define slog & syslog-ng

Answer 6

Syslog-like implementations on Linux if it doesn’t have syslog

Question 7

Define journalctl

Answer 7

A tool that allows querying logs stored in a special binary format on Linux systems

Question 8

Define NXLog

Answer 8

A syslog alternative that runs as daemon on Linux

Question 9

Define NetFlow

Answer 9

A standard for gathering network statistics from switches, routers, and other devices into a central repository for analysis that is compatible with multiple manufacturers

Question 10

Define IP flow information export (IPFIX)

Answer 10

Newer version of NetFlow with extended capabilities

Question 11

Define sFlow

Answer 11

NetFlow and IPFIX can consume resources during collection so sFlow is alternative solution that just takes samples of network traffic to reduce resource usage