INTRODUCTION – Network Traffic and Logs Using IDS and SIEM Tools

TEST YOUR KNOWLEDGE: OVERVIEW OF LOGS

1. What is the primary purpose of logs during incident investigation?

2. A security analyst wants to determine whether a suspicious login was successful. Which log type would be most useful for this purpose?

3. In the following log, what action does the log entry record?

[ALLOW: wikipedia.org] Source: 192.167.1.1 Friday, 10 June 2022 11:36:12

4. Fill in the blank: _____ is the process of examining logs to identify events of interest.

TEST YOUR KNOWLEDGE: LOG COMPONENTS AND FORMATS

1. Examine the following authentication log:

[2022/12/20 08:20:38.921286] User nuhara logged in successfully

What type of information does this log contain? Select two answers.

2. Which of the following capabilities can syslog be used for? Select three answers.

3. What are examples of log formats? Select three answers.

4. Which log format uses tags to structure data?

TEST YOUR KNOWLEDGE: OVERVIEW OF INTRUSION DETECTION SYSTEMS (IDS)

1. A security analyst uses a network protocol analyzer to capture HTTP traffic to analyze patterns. What type of data are they using?

2. Which statement accurately describes the difference between a network-based intrusion detection system (NIDS) and a host-based intrusion detection system (HIDS)?

3. Fill in the blank: The _____ component of an IDS signature includes network traffic information.

4. A security analyst creates a Suricata signature to identify and detect security threats based on the direction of network traffic. Which of the following rule options should they use?

5. When monitoring activity, what specifies the rules used by an intrusion detection system (IDS)?

6. Which of the following is true when it comes to analyzing Suricata signatures?

TEST YOUR KNOWLEDGE: OVERVIEW OF SIEM TOOLS

1. In Search Processing Language (SPL), which special character is a wildcard that can be used to substitute with any other character?

2. Which of the following steps are part of the security information and event management (SIEM) process? Select three answers.

3. Fill in the blank: Chronicle uses _____ to search through unstructured logs.

4. Which of the following is Splunk’s query language?

5. Which of the following steps are involved in the SIEM process for data collection? Select three answers.

6. Do specific queries improve the speed and relevance of SIEM search results?

7. Fill in the blank: Chronicle uses _____ to search through normalized data.

MODULE 4 CHALLENGE

1. What is the difference between a log and log analysis?

2. Fill in the blank: A syslog entry contains a header, _____, and a message.

3. What is the difference between a network-based intrusion detection system (NIDS) and a host-based intrusion detection system (HIDS)?

4. What are examples of common rule actions that can be found in signature? Select three answers.

5. Which rule option is used to match based on the direction of network traffic?

6. What is the difference between network telemetry and network alert logs?

7. Fill in the blank: The asterisk symbol is also known as a(n) _____.

8. Which step in the SIEM process involves the processing of raw data into a standardized and structured format?

9. Examine the following log:

{
	“name”: “System test”,
	“host”: "167.155.183.139",
	“id”: 11111,
	“Message”: [error] test,
}

Which log format is this log entry in?

10. Fill in the blank: _____ analysis is a detection method used to find events of interest using patterns.

11. Which rule option is used to indicate the number of times a signature is updated?

12. Which type of log data does Suricata generate? Select all that apply.

13. Fill in the blank: Chronicle uses ______ to define detection rules.

14. What are the steps in the SIEM process for data collection? Select three answers.

15. Examine the following log:

[2022/12/21 17:46:35.232748] NOTIFY: NetworkPropertiesUpdated: wifi_psk_13

Which type of log is this?

16. What information is included in a signature’s header? Select all that apply.

17. Examine this Suricata signature:

alert http 167.215.72.95 any -> 156.150.71.141 80 (msg:”GET on wire”; flow:established,to_server; content:”GET”; sid:12345; rev:2;)

What is the destination port?

18. Fill in the blank: Suricata uses the _____ format for event and alert output.

19. Which querying language does Splunk use?

20. Which of the following refers to a record of events that occur within an organization’s systems?

21. Consider the following scenario:

A security analyst at a midsized company is tasked with installing and configuring a host-based intrusion detection system (HIDS) on a laptop. The security analyst installs the HIDS and wants to test whether it is working properly by simulating malicious activity. The security analyst runs unauthorized programs on the laptop, which the HIDS successfully detects and alerts on.

What is the laptop an example of?

22. Which symbol is used to indicate a comment and is ignored in a Suricata signature file?

23. What is the method to search for normalized data in Chronicle?

24. What details do logs contain? Select all that apply.

25. Which type of Splunk query searches through unstructured log records?

26. Which Unified Data Model (UDM) field search specifies a security action?

CONCLUSION – Network Traffic and Logs Using IDS and SIEM Tools