Security Information & Event Management Flashcards

A SOC analyst must demonstrate regulatory compliance by showing all privileged user activity was logged for the past 12 months. Which SIEM capability supports this requirement?

Answer: Long-term log retention with tamper-evident audit trails

Compliance reporting relies on long-term, tamper-evident log retention that proves privileged user activity was captured and unaltered.

What is the purpose of a 'lookup table' (reference data) in SIEM rule logic?

Answer: To allow rules to reference external lists like known bad IPs or authorized service accounts

Lookup tables let correlation rules reference external data sets—such as threat intel IP lists or whitelisted accounts—to improve accuracy.

During incident response, an analyst needs to determine which internal host first communicated with a malicious IP. Which SIEM query type is MOST appropriate?

Answer: Historical forensic search filtered by destination IP and sorted by earliest timestamp

A historical search filtered by the malicious destination IP and sorted chronologically identifies the patient-zero host and initial contact time.

Which of the following BEST describes 'threat hunting' in relation to a SIEM?

Answer: Proactively querying SIEM data to find threats that have evaded automated detection

Threat hunting involves analysts actively searching SIEM data for indicators of compromise that automated rules have not yet detected.

A SIEM alert fires for 'Impossible Travel' — a user authenticated from New York at 9:00 AM and then from London at 9:15 AM. What does this indicate?

Answer: Possible credential compromise or account sharing across geographically distant locations

Impossible travel alerts flag authentication from two geographically distant locations within a time window physically impossible to bridge, suggesting stolen credentials.

Which ingestion method provides the MOST reliable, ordered delivery of logs from a Windows host to a SIEM?

Answer: Windows Event Forwarding (WEF) over WinRM/HTTPS to a Windows Event Collector

Windows Event Forwarding over WinRM provides reliable, subscription-based log delivery with guaranteed ordering and delivery acknowledgment.

What is a key difference between a SIEM and a traditional log management system?

Answer: A SIEM adds real-time correlation, alerting, and threat detection on top of log collection and storage

While both store logs, a SIEM adds real-time correlation engines, behavioral analytics, and alerting to transform raw logs into actionable security intelligence.