Security Information & Event Management Flashcards

Which SIEM component is responsible for normalizing log data from heterogeneous sources into a common format?

Answer: Log normalization parser

The log normalization parser transforms raw log data from diverse sources into a consistent, structured format for analysis.

A SIEM generates an alert every time a user logs in outside business hours. After a week, analysts begin ignoring these alerts. This is an example of:

Answer: Alert fatigue caused by excessive false positives

Alert fatigue occurs when too many low-fidelity or false-positive alerts cause analysts to desensitize and miss real threats.

What is the primary purpose of baselining in a SIEM environment?

Answer: To establish normal behavior so anomalies can be detected

Baselining establishes what 'normal' activity looks like so that deviations—potential threats—trigger meaningful alerts.

Which log source would be MOST valuable in a SIEM for detecting lateral movement within a network?

Answer: Windows Security Event Logs (authentication/logon events)

Windows Security Event Logs capture authentication and logon events that reveal account usage patterns indicative of lateral movement.

An analyst notices that SIEM correlation rules are triggering alerts based on mismatched timestamps between sources. What is the BEST remediation?

Answer: Implement NTP synchronization across all log sources

NTP synchronization ensures all devices report consistent timestamps, enabling accurate time-based event correlation.

Which SIEM feature allows analysts to search historical log data to reconstruct a timeline of a past security incident?

Answer: Forensic log search and replay

Forensic log search and replay enables analysts to query retained logs and reconstruct the sequence of events in a past incident.

A SIEM rule fires when 5 failed logins occur within 2 minutes from the same IP. What type of attack is this rule designed to detect?

Answer: Brute-force or password-spraying attack

Repeated rapid login failures from a single source are a hallmark of brute-force or password-spraying attacks.