Security Operations Fundamentals Flashcards
Components of SOAR
Orchestration
Automation
Reponse
SOAR
SOAR tools ingest aggregated alerts from detection sources (such as SIEMs, network security tools, and mailboxes) before executing automatable, process-driven playbooks to enrich and respond to these alerts.
SIEM
SIEM’s collect disparate pieces of data and aggregate them into alerts.
What tool or technology can the security operations team use to ingest aggregated alerts and execute an automated process-driven playbook?
SOAR
What is the name of Palo’s XDR solution?
Cortex XDR
Exploits
Exploits are the results of techniques used against a system that is designed to gain access through vulnerabilities in the code of an operating system or application.
Malware
Malware is a file or code that infects, explores, steals, or conducts virtually any behavior an attacker wants.
Ransomware
Ransomware is a form of malware that holds valuable files, data, or information for ransom, often by encrypting data, with the attacker holding the decryption key.
Palo’s native threat intelligence is powered by what?
Unit 42
What Is Native Threat Intelligence?
Native threat intelligence, powered by Unit 42, provides intel from multiple Palo Alto Networks services. Using native threat intelligence, you can investigate indicators and their behaviors and use that knowledge to better safeguard your network from malicious activity.
Native Threat Intelligence provides data from?
WF - Wildfire
UF - URL Filtering database
Internal Unit 42 team
Third party feeds
WF
Wildfire - cloud based malware sandbox
UF
PAN URL Filtering database
Threat Intel Interface Tabs
XSOAR Indicators
Sample Analysis
Sessions and Submissions
Threat Intel Reports
XSOAR Indicators
You can now perform lookups in Unit 42 Intel for IP addresses, URLs, domains, and SHA-256 hashes.
Sample Analysis
Unit 42 Intel provides a full report of activities, properties, and behaviors associated with file samples, enabling you to find links between attacks and analyze threat patterns.
Sessions and Submissions
You can now use sessions and submissions data from Palo Alto Networks firewalls, WildFire, Cortex XDR, Prisma SaaS, and Prisma Access for investigation and analysis.
Threat Intel Reports
You can now publish a report and access threat intel reports written by other analysts.
Benefits of Native Threat Intelligence
1 - Act with Confidence
2 - Inform Next Steps in Response
3 - Identify and Monitor new threats
What are three data sources security operations teams can use to investigate indicators and their behaviors? (Choose three.)
Unit 42
URL Filtering Database
Wildfire
Which Threat Intel interface tab allows you to perform lookups in Unit 42 Intel IP addresses, URLs, domains, and SHA-256 hashes?
XSOAR Indicators
Elements of Security Operations
details the building blocks of simpler, more effective security operations, drawing from our experts’ real-world experiences to help you build capabilities that deserve your confidence. You’ll learn how you can:
