4.3 Incident, utilize appropriate data sources to support investigation Flashcards
Vulnerability scan output: what a vuln scan can tell you ?
- There is a lack of security controls: no firewall, no anti-virus, no anti-spyware
- Misconfigurations: open shares, guest access
- Real vunerabilities
Vulnerability scan output: how to prevent false positives / negatives ?
Ensure your scanner is updated with the latest signatures
SIEM dashboard: what is a SIEM ?
Logging of security events and information. You got security alerts real-time.
Also able to do data correlation and forensic analysis
SIEM dashboard: where a SIEM gather information?
- OS
- Infrastructure devices
- NetFlow sensors
SIEM dashboard: how a SIEM get information ?
Using sensors and logs
Log files: what can you find in network log files ?
Data form switches, routers, access point, VPN concentrators. It can be:
- network changes: touting updates, authentication issues, network issues
Log files: what can you find in system log files ?
OS informaton: extensive logs, files system information, authentication details, security events
Log files: what can you find in application log files ?
Log specific to the application
Log files: where can you find application log files in Linux/ Windows ?
/var/log directory
Log files: what can you find in security log files ?
Detailes security-related information: blocked and allowed traffic flows, exploit attempts, blocked URL categories, DNS sinkhole traffic,
Log files: what can you find in firewall log files ? And WAF?
Information on the traffic flows: deny website packet, blocked packet
WAF provide additional info on certains attacks (XSS, SQLi)
Log files: what can you find in web log files ?
- Web server access: IP address, web page URL
- Access errors: unauthorized folder/ file
- Exploit attempts
- Server activity: startup, shutdown, restart message
Log files: what can you find in DNS log files ?
- Queries made to the DNS
- IP address of the request
- Identify queries to known bad URLs
- Block or modify known bad request at the DNS server
Log files: what can you find in authentication log files ?
- Know who logged in: account names, source IP address, authentication method
- Identify multiple failures
- Correlate with other events: file transfer, app installation etc
Log management: what is syslog?
Protocol that computer systems use to send event data logs to a central location for storage (SIEM)
