Exabeam Analyst cheat sheet

TDIR lifecycle stages: detection (alert generation), triage (severity and validity), investigation (scope and root cause), containment, eradication, recovery, and post-incident lessons learned.

Detection engineering rule: a detection is only as good as its test data; each rule needs a known-bad sample and a known-good baseline to measure false positive rate.

Alert triage decision rule: confirm the entity is real and the activity is anomalous before escalating; an alert on a service account with a documented automation window is usually benign.

Investigation pivot order: user to host to process to network destination to peer users; each pivot should narrow scope or reveal lateral movement.

MITRE ATT&CK tactic order for timeline reconstruction: initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, impact.

Severity formula in practice: severity rises with confirmed malicious intent, privileged account involvement, and number of affected hosts; a single low-confidence alert on a standard user is low severity.

Containment decision rule: isolate a host when active command-and-control or credential dumping is confirmed; preserve volatile memory and logs before reimaging.

Mean time to detect (MTTD) and mean time to respond (MTTR) are computed from alert creation, first analyst touch, and case closure timestamps; they measure process, not tool coverage.

Case documentation must record the query or evidence source for every conclusion, because a finding without a reproducible source cannot be defended in review.

UEBA baselines are per-entity and time-aware: a peer group is built from attributes such as department, role, manager, and location, and deviations are scored against that group.

Risk score is cumulative and decays; a single anomalous event adds points, and inactivity or normal behavior over time reduces the score, so thresholds should be tuned on decay half-life.

Common behavioral features: login time-of-day, source geography, session duration, authentication failure ratio, data volume per session, and first-seen versus known asset usage.

First-seen detection rule: a user authenticating from a new country or a new device is not inherently malicious; it becomes high risk when combined with privileged access or sensitive data access.

Peer group anomaly logic: compare the entity to its own history and to its peers; a deviation from self but not from peers may reflect a role change rather than an attack.

Entity types scored by UEBA include users, service accounts, hosts, applications, and databases; service accounts need separate baselines because their behavior is machine-driven.

Low-and-slow detection relies on aggregation windows (for example 7 to 30 days) rather than single-event thresholds, since per-event volume stays under static limits.

Risk-based alerting reduces noise by triggering an investigation only when cumulative entity risk crosses a defined threshold, rather than on every individual rule hit.

Model tuning rule: raise thresholds when false positives cluster on a specific peer group; investigate the peer group definition before suppressing the rule.

Pipeline stages: collection (agents, syslog, API connectors), parsing and normalization to a common schema, enrichment (asset, identity, threat intel), indexing, retention, and search.

Normalization maps vendor fields to a common schema so that a single query works across sources; unparsed or raw-only events are searchable but not reliably correlatable.

Log source health monitoring: track events per second per source and alert on a drop to zero, because a silent source creates a detection blind spot.

Retention tiers: hot storage for fast search on recent data (weeks), warm for slower search, and cold or archive for compliance; query performance degrades as the window widens.

Time synchronization matters: correlate on normalized UTC timestamps, since clock skew between sources breaks sequence reconstruction.

Correlation rule types: single-event, threshold (N events in T seconds), sequence (A then B), and absence-of-event rules that fire when an expected log never arrives.

Ingest cost control: filter or drop high-volume low-value logs at the collector, and keep full fidelity for authentication, endpoint, and network perimeter sources.

Identity enrichment is critical: resolve IP to asset to assigned user so that an alert names a person, not just an address, and account for DHCP and VPN address reuse.

Search performance rule: narrow by indexed fields (user, host, time range) before free-text search, and avoid leading wildcards in high-volume queries.

Insider threat categories: the careless user, the compromised account, and the malicious insider; each needs different detection logic and response handling.

Leading indicators of malicious insider activity: access to data outside the user's role, volume spikes near resignation or performance review dates, and use of personal cloud storage or USB devices.

ABA focuses on the endpoint agent and the process tree: parent-child process relationships, command-line arguments, script interpreters spawning from office applications, and unsigned binaries.

Data exfiltration signals: large uploads to unfamiliar destinations, compression of many files before transfer, and printing or copying of sensitive documents at unusual hours.

Privilege misuse rule: an administrator accessing sensitive data without a matching change ticket or approved task is a higher-risk signal than a standard user doing the same.

Departure risk window: elevated monitoring applies from notice of resignation through the last working day, since bulk copying frequently occurs in that period.

Least-privilege review: compare granted permissions against actual usage over 30 to 90 days; unused entitlements are both a hygiene and an insider-risk finding.

Chain of custody and privacy: insider investigations require HR and legal involvement, documented evidence handling, and proportionality, because monitoring employee behavior carries legal risk.

Deception controls such as honeytokens and canary files generate high-fidelity alerts, since legitimate users have no reason to open a file that is not referenced anywhere.