Threat Detection and Monitoring
Threat Detection and Monitoring
This domain tests how you choose telemetry, build and tune detections, and separate real malicious activity from noise. Questions often hinge on which log source would confirm a hypothesis.
Core rules and concepts
- Common telemetry: firewall and proxy logs, NetFlow/IPFIX, DNS query logs, EDR process and network events, authentication logs, and IDS/IPS alerts.
- Signature detection matches known patterns and is high-fidelity for known threats. Anomaly detection compares against a baseline and produces more false positives; it needs a stable baseline and a feedback loop.
- NTP time synchronization is a detection control. Skewed clocks break correlation and timelines.
- Map detections to MITRE ATT&CK techniques to find coverage gaps; a technique with no data source is a blind spot.
- Detection engineering is a lifecycle: hypothesis, data source, rule logic, test, tune, document. Tune to reduce noise, not to zero alerts.
Worked example
DNS logs show one workstation sending about 120 queries per hour to random-looking subdomains of a single parent domain, mostly TXT records, roughly every 30 seconds. The pattern suggests DNS tunneling or beaconing: high query volume, high-entropy labels, unusual record type, and regular timing. Reasoning: verify domain reputation, compute label entropy, and pivot to EDR to identify the process making the queries. Do not simply block the domain and close; isolate the host, capture evidence, and check for other hosts querying the same parent.
Traps that cost marks
- Equating alert volume with severity.
- Ignoring time-zone or NTP skew when correlating.
- Tuning a rule until it never fires.
- Confirming compromise from one signature hit.
- Relying on a single log source.