Security Information & Event Management Flashcards

A SIEM detects a spike in DNS queries to newly registered domains from multiple internal hosts simultaneously. What threat does this MOST likely indicate?

Answer: Domain generation algorithm (DGA) malware beaconing

DGA malware generates many pseudo-random domain names to locate C2 servers, resulting in high volumes of queries to newly registered or unknown domains.

Which SIEM integration enables automated ticket creation in a helpdesk system when a high-severity alert fires?

Answer: SOAR (Security Orchestration, Automation, and Response) playbook integration

SOAR playbooks can automate response actions including ticket creation, enrichment, and notification when triggered by SIEM alerts.

What does the term 'EPS' mean in the context of SIEM sizing?

Answer: Events Per Second — a measure of ingestion throughput

EPS (Events Per Second) measures how many log events a SIEM must ingest and process, which determines hardware and licensing requirements.

An attacker exfiltrates data by encoding it in DNS TXT records. Which SIEM data source would BEST help detect this?

Answer: DNS server query logs with TXT record visibility

DNS server logs capturing TXT record query volume and size can reveal DNS tunneling used to exfiltrate data covertly.

Which framework is commonly used to map SIEM detection rules to known adversary tactics and techniques?

Answer: MITRE ATT&CK

MITRE ATT&CK provides a structured taxonomy of adversary tactics and techniques that SIEM rules can be mapped to for coverage analysis.

A SIEM shows a sudden increase in 'Account Lockout' events across 200 workstations within 10 minutes. What is the MOST likely cause?

Answer: A password-spraying attack causing account lockouts

Simultaneous lockouts across many accounts in a short window are a classic indicator of a password-spraying attack targeting Active Directory.

Which log source provides the MOST complete view of process execution on a Windows endpoint for threat hunting in a SIEM?

Answer: Windows Sysmon event logs (Event ID 1 — Process Create)

Sysmon Event ID 1 logs process creation with command-line arguments, parent process, and hashes — critical for detecting malicious execution.