Unit 2: SIEM Review

Question 1

What does SIEM combine?

Answer 1

SIEM is a term for software and products services combining security information management (SIM) and security management (SEM)

Question 2

What is long-term data retention critical for?

Answer 2

It is critical in forensic investigations as it is unlikely that discovery of a network breach will be at the time of the breach occurring.

Question 3

What type of attacks do cloud-based SIEM services have trouble recognizing?

Answer 3

Low-and-slow attacks

Question 4

What does forensics analysis mitigate?

Answer 4

Having to aggregate log information in your head or having to search through thousands and thousands of logs.