Logging & SIEM interview questions

1. A.User and Entity Behavior Analytics baselining normal behavior to flag anomalous activity
2. B.an attacker altering or deleting logs to hide their activity, countered by immutable logging
3. C.scalable store for large volumes of raw security telemetry queried for hunting and analytics
4. D.collecting logs from many sources into a central store for search and analysis

Answer + AI explanation with Pro

1. A.Alert fatigue
2. B.MITRE ATT&CK
3. C.UEBA
4. D.Log aggregation

Answer + AI explanation with Pro

1. A.Log aggregation — an attacker altering or deleting logs to hide their activity, countered by immutable logging
2. B.Log aggregation — collecting logs from many sources into a central store for search and analysis
3. C.Log aggregation — designing, testing, and maintaining rules and analytics that surface malicious activity
4. D.Log aggregation — automated notification triggered when monitored data matches a detection rule

Answer + AI explanation with Pro

1. A.collecting logs from many sources into a central store for search and analysis
2. B.designing, testing, and maintaining rules and analytics that surface malicious activity
3. C.SIEM logic linking events across sources to detect a multi-step attack pattern
4. D.record of security-relevant events such as logins, permission changes, and access

Answer + AI explanation with Pro

1. A.Detection engineering
2. B.Audit log
3. C.Alert
4. D.Correlation rule

Answer + AI explanation with Pro

1. A.Audit log — User and Entity Behavior Analytics baselining normal behavior to flag anomalous activity
2. B.Audit log — record of security-relevant events such as logins, permission changes, and access
3. C.Audit log — policy defining how long logs are kept to satisfy investigation and compliance needs
4. D.Audit log — designing, testing, and maintaining rules and analytics that surface malicious activity

Answer + AI explanation with Pro

1. A.scalable store for large volumes of raw security telemetry queried for hunting and analytics
2. B.record of security-relevant events such as logins, permission changes, and access
3. C.automated notification triggered when monitored data matches a detection rule
4. D.User and Entity Behavior Analytics baselining normal behavior to flag anomalous activity

Answer + AI explanation with Pro

1. A.Alert
2. B.Detection-as-code
3. C.MITRE ATT&CK
4. D.Detection engineering

Answer + AI explanation with Pro

1. A.Alert — SIEM logic linking events across sources to detect a multi-step attack pattern
2. B.Alert — policy defining how long logs are kept to satisfy investigation and compliance needs
3. C.Alert — knowledge base of adversary tactics and techniques used to map detection coverage
4. D.Alert — automated notification triggered when monitored data matches a detection rule

Answer + AI explanation with Pro

1. A.policy defining how long logs are kept to satisfy investigation and compliance needs
2. B.collecting logs from many sources into a central store for search and analysis
3. C.record of security-relevant events such as logins, permission changes, and access
4. D.designing, testing, and maintaining rules and analytics that surface malicious activity

Answer + AI explanation with Pro

1. A.Detection-as-code
2. B.Detection engineering
3. C.Log retention
4. D.Alert

Answer + AI explanation with Pro

1. A.Log retention — automated notification triggered when monitored data matches a detection rule
2. B.Log retention — managing detection rules in version control with testing and CI like software
3. C.Log retention — policy defining how long logs are kept to satisfy investigation and compliance needs
4. D.Log retention — an attacker altering or deleting logs to hide their activity, countered by immutable logging

Answer + AI explanation with Pro

1. A.policy defining how long logs are kept to satisfy investigation and compliance needs
2. B.managing detection rules in version control with testing and CI like software
3. C.SIEM logic linking events across sources to detect a multi-step attack pattern
4. D.an attacker altering or deleting logs to hide their activity, countered by immutable logging

Answer + AI explanation with Pro

1. A.Audit log
2. B.Alert
3. C.Correlation rule
4. D.UEBA

Answer + AI explanation with Pro

1. A.Correlation rule — automated notification triggered when monitored data matches a detection rule
2. B.Correlation rule — designing, testing, and maintaining rules and analytics that surface malicious activity
3. C.Correlation rule — SIEM logic linking events across sources to detect a multi-step attack pattern
4. D.Correlation rule — policy defining how long logs are kept to satisfy investigation and compliance needs

Answer + AI explanation with Pro

1. A.desensitization from excessive or noisy alerts that causes real threats to be missed
2. B.scalable store for large volumes of raw security telemetry queried for hunting and analytics
3. C.designing, testing, and maintaining rules and analytics that surface malicious activity
4. D.collecting logs from many sources into a central store for search and analysis

Answer + AI explanation with Pro

1. A.Log tampering
2. B.UEBA
3. C.Detection engineering
4. D.Detection-as-code

Answer + AI explanation with Pro

1. A.Detection engineering — policy defining how long logs are kept to satisfy investigation and compliance needs
2. B.Detection engineering — record of security-relevant events such as logins, permission changes, and access
3. C.Detection engineering — knowledge base of adversary tactics and techniques used to map detection coverage
4. D.Detection engineering — designing, testing, and maintaining rules and analytics that surface malicious activity

Answer + AI explanation with Pro

1. A.policy defining how long logs are kept to satisfy investigation and compliance needs
2. B.managing detection rules in version control with testing and CI like software
3. C.desensitization from excessive or noisy alerts that causes real threats to be missed
4. D.an attacker altering or deleting logs to hide their activity, countered by immutable logging

Answer + AI explanation with Pro

1. A.Alert fatigue
2. B.Log retention
3. C.UEBA
4. D.MITRE ATT&CK

Answer + AI explanation with Pro

1. A.Alert fatigue — desensitization from excessive or noisy alerts that causes real threats to be missed
2. B.Alert fatigue — policy defining how long logs are kept to satisfy investigation and compliance needs
3. C.Alert fatigue — collecting logs from many sources into a central store for search and analysis
4. D.Alert fatigue — designing, testing, and maintaining rules and analytics that surface malicious activity

Answer + AI explanation with Pro

1. A.scalable store for large volumes of raw security telemetry queried for hunting and analytics
2. B.an attacker altering or deleting logs to hide their activity, countered by immutable logging
3. C.managing detection rules in version control with testing and CI like software
4. D.User and Entity Behavior Analytics baselining normal behavior to flag anomalous activity

Answer + AI explanation with Pro

1. A.UEBA
2. B.Log tampering
3. C.Alert fatigue
4. D.Detection engineering

Answer + AI explanation with Pro

1. A.Log tampering — record of security-relevant events such as logins, permission changes, and access
2. B.Log tampering — managing detection rules in version control with testing and CI like software
3. C.Log tampering — collecting logs from many sources into a central store for search and analysis
4. D.Log tampering — an attacker altering or deleting logs to hide their activity, countered by immutable logging

Answer + AI explanation with Pro

1. A.designing, testing, and maintaining rules and analytics that surface malicious activity
2. B.User and Entity Behavior Analytics baselining normal behavior to flag anomalous activity
3. C.automated notification triggered when monitored data matches a detection rule
4. D.scalable store for large volumes of raw security telemetry queried for hunting and analytics

Answer + AI explanation with Pro

1. A.Alert
2. B.UEBA
3. C.Detection engineering
4. D.Detection-as-code

Answer + AI explanation with Pro

1. A.UEBA — User and Entity Behavior Analytics baselining normal behavior to flag anomalous activity
2. B.UEBA — automated notification triggered when monitored data matches a detection rule
3. C.UEBA — desensitization from excessive or noisy alerts that causes real threats to be missed
4. D.UEBA — collecting logs from many sources into a central store for search and analysis

Answer + AI explanation with Pro

1. A.an attacker altering or deleting logs to hide their activity, countered by immutable logging
2. B.knowledge base of adversary tactics and techniques used to map detection coverage
3. C.scalable store for large volumes of raw security telemetry queried for hunting and analytics
4. D.record of security-relevant events such as logins, permission changes, and access

Answer + AI explanation with Pro

1. A.MITRE ATT&CK
2. B.Detection-as-code
3. C.Data lake (security)
4. D.Correlation rule

Answer + AI explanation with Pro

1. A.MITRE ATT&CK — User and Entity Behavior Analytics baselining normal behavior to flag anomalous activity
2. B.MITRE ATT&CK — desensitization from excessive or noisy alerts that causes real threats to be missed
3. C.MITRE ATT&CK — knowledge base of adversary tactics and techniques used to map detection coverage
4. D.MITRE ATT&CK — record of security-relevant events such as logins, permission changes, and access

Answer + AI explanation with Pro