Chapter_11_CVE's and IoC's Flashcards
1
Q
What part of Silent Defense runs the CVE and IoC checks?
A
The Industrial Threat Library (ITL) contains the CVE and IoC checks
2
Q
When updating the CVE and IOC databases, what should be checked?
A
The synchronization status of each database for all Sensors
3
Q
What blacklists are checked by the Network Indicators of Compromise (IoCs)?
A
DNS domains, IP address, file operations, &SSL client applications
4
Q
How are file Indicators of Compromise (IoC’s) checked?
A
YARA rules and malicious file hashes
5
Q
How often are CVE and IOC updates published byForescout?
A
Monthly
6
Q
How do you update them in a SilentDefense deployment?
A
From Settings > Services > CVE and IOCs > Import submenu button
7
Q
Once updated, what should be done?
A
Sync and scan historical network logs
