Log Data 4.9 Flashcards
1
Q
Security Log Files
A
- Detailed security-related information
2
Q
Information Stored on Security Log Files
A
- Blocked and allowed traffic flows
- Exploit attempts
3
Q
Firewall Logs
A
- Contains detailed information about the traffic
- Logs information pertaining to the source/destination IP, port numbers, disposition
4
Q
Logs for Next Generation Firewalls (NGFW)
A
- Provides information regarding the applications that are being used.
- URLs being filtered
5
Q
Application Logs
A
- The information is specific to the application and varies widely.
- Logged information is collected into a SIEM, unneeded info is filtered out
6
Q
Endpoint Logs
A
- Collects information on logon events, policy changes, system events, processes, account management, directory services, etc.,
- Information can be collected on SIEM
- Can correlate the information to other devices.
7
Q
OS-Specific Security Logs
A
- Collect information pertaining to an OS security event such as brute force or authentication details.
- Can provide information of security problem before a security incident occurs
- May require filtering due to amount of data being collected
8
Q
Intrusion Prevention System (IPS) / Intrusion Detection System (IDS)
A
- Logs contain known information of vulnerabilities and attacks
9
Q
Network Logs
A
- Logs that collect information of activity occurring on switches, access points, VPN concentrators, etc.,
- Provides information of routing updates, authentication issues, or network security issues.
10
Q
Metadata
A
- Information contained within the documents being transferred through the network
- Describes the particular file
11
Q
Vulnerability Scans
A
- Identifies vulnerabilities such as lack of firewalls, no anti-virus software, or anti-spyware.
- Can identify misconfigurations and additional vulnerabilities
12
Q
Automated Reports
A
- An automated report system will use a generator such as SIEM which can be built-in
- Can also be provided by a third party extension
13
Q
Considerations for Automated Reports
A
- Requires someone to read the reports
- Can produce large amounts of data and must considerate what type of data is needed for the automation process.
14
Q
Dashboards
A
- Summaries of a real time status information on a single screen
- Can customize the dashboard to show only relevant or important information being displayed.
- Not designed for long term analysis.
15
Q
Packet Captures
A
- Being able to analyze packets flows over the network provides information on operations of the networking equipment, applications, and security issues.
- Can be done using a third party extension.
