Security Monitoring, Logging, and Incident Response
What this domain tests
This domain covers log sources, centralized monitoring, correlation, retention, time synchronization, and the incident-response lifecycle. Expect questions on evidence handling and the order of containment versus eradication.
Core rules
- Useful log sources: endpoint protection, Windows/Syslog events, firewall, proxy, IDS/IPS, DLP, and authentication logs.
- SIEM correlation turns individual events into alerts; it depends on normalized, time-synchronized logs.
- NTP matters because out-of-order timestamps break timelines and correlation.
- Retention must satisfy policy and legal requirements; short retention destroys investigation evidence.
- IR phases: preparation, identification, containment, eradication, recovery, lessons learned. Containment limits spread; eradication removes the cause.
- Preserve volatile evidence before rebooting or wiping a host, and maintain chain of custody.
Worked example
Ransomware is detected on one workstation. Reasoning: isolate the host from the network first to limit encryption and lateral movement, but do not power it off before capturing memory if policy allows. Identify the account and process, check neighboring hosts for the same behavior, and preserve logs. Then eradicate the malware, restore from a known-good backup, and validate before reconnecting. A lessons-learned review should address the initial access vector and backup restoration time.
Traps
- Wiping or reimaging before collecting evidence.
- Treating containment as eradication.
- Missing NTP drift and retention gaps.
- Ignoring proxy and DNS logs during investigations.
- Restoring a host without confirming the persistence mechanism is removed.