XDR Analyst flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

XDR definition

A platform that collects and correlates telemetry from endpoint, network, identity, email, and cloud sources into unified detections and response actions, rather than operating as a single isolated sensor.

Normalization schema

A common field model such as ECS or OCSF that maps vendor-specific log fields into consistent names, enabling detections and correlations to work across heterogeneous data sources.

Entity resolution

The process of mapping raw identifiers like hostnames, IPs, and usernames to canonical assets and identities, preventing one intrusion from fragmenting into many disconnected alerts.

Telemetry health metric

A coverage measure tracking the percentage of enrolled endpoints reporting recently and flagging ingestion gaps or parser failures, since missing data silently blinds detections.

Process lineage

The parent-child relationship chain of process execution, a core EDR detection primitive that reveals malicious execution flows single-event rules miss, such as Office spawning PowerShell.

LOLBins

Legitimate signed operating system binaries such as certutil, mshta, rundll32, and regsvr32 that attackers abuse for download, execution, or persistence; detection relies on command-line arguments rather than binary reputation.

LSASS credential access

Unauthorized processes opening handles to lsass.exe with read rights, or tools like comsvcs.dll MiniDump being invoked, indicating credential dumping that precedes lateral movement.

Endpoint isolation

A reversible containment action that blocks most network traffic to and from a host while preserving the agent's management connection, preferred over shutdown because it retains volatile evidence.

Sysmon Event ID 1

Records process creation with image path, command line, parent process, user, and hashes; the highest-value Windows endpoint telemetry source for behavioral detection.

Beaconing detection

Identifying command-and-control by measuring inter-arrival time variance of repeated connections to the same destination; low variance with consistent payload sizes over many connections is suspicious.

DNS tunneling indicators

High volumes of TXT or NULL queries, unusually long encoded subdomain labels with high entropy, and many unique subdomains under one authoritative domain.

Cloud control-plane logs

Audit records of management API calls such as CloudTrail or Azure Activity Log; high-value events include CreateAccessKey, AttachUserPolicy, and StopLogging.

Flow log limitations

VPC and NSG flow logs provide 5-tuple records with byte counts but no payload, and sampling means absence of a flow is not proof of no traffic.

East-west traffic

Internal lateral communication between hosts; anomalies on SMB, RDP, WinRM, and Kerberos between workstations often indicate post-compromise movement rather than normal operations.

Impossible travel

A detection comparing consecutive successful authentications to compute implied velocity exceeding physical travel; false positives arise from VPN egress, carrier NAT, and cloud proxies.

MFA fatigue attack

Repeated push notification prompts sent to a victim until they approve; detected by joining many denied MFA events to a later success from the same user and source.

DMARC alignment

A policy that requires SPF or DKIM to align with the visible From domain and instructs receivers to none, quarantine, or reject failing mail.

Business email compromise

Fraud using lookalike or new domains, reply-to mismatches, urgency language, and thread hijacking to trick recipients into payments or credential disclosure.

Token theft

Stealing OAuth refresh tokens to bypass MFA; indicators include anomalous token use, new device registrations, and mailbox rule creation after a suspicious sign-in.

Intelligence pyramid

A model ranking indicators by durability: hashes and IPs are cheap and short-lived, while tactics, techniques, and procedures are expensive for adversaries to change.

Indicator TTL

An expiry assigned to threat intelligence indicators, requiring revalidation before use because stale IP and domain indicators cause false positives as infrastructure is repurposed.

MITRE ATT&CK

A knowledge base of adversary tactics and techniques used to map detections to behaviors, enabling coverage gap analysis across the attack lifecycle.

Sigma rules

A vendor-neutral detection rule format that compiles to multiple SIEM query languages, supporting portable detection-as-code with version control and peer review.

Stack counting

A hunting query pattern that groups events by a field combination and sorts by count, surfacing rare parent-child process pairs or uncommon command lines.

Purple teaming

Executing known adversary techniques with tools like Atomic Red Team or CALDERA and measuring which detections fire, producing a concrete list of coverage gaps.

Severity calculation

Alert severity derives from asset criticality, identity privilege, detection confidence, and blast radius, not from the alert source alone.

Containment ordering

Actions ordered by reversibility: revoke sessions and reset passwords, isolate the endpoint, disable the account, and reimage the host only as a last resort.

Volatile evidence

Data such as memory contents, running processes, and active network connections that is lost on shutdown and must be captured before containment or reboot.

SOAR approval gate

A conditional step requiring human authorization before destructive actions like deletion, reimage, or mass changes, while reversible actions execute automatically.

MTTD and MTTR

Mean time to detect and mean time to respond; tracked per detection rule to identify noisy, slow, or ineffective detections for tuning.

Blast radius

The scope of systems, identities, and data an intrusion can reach from a compromised entity, a key input to incident severity and containment urgency.

Mailbox persistence

Attacker-created forwarding rules, delegate access grants, and OAuth consent grants that survive password resets and must be enumerated during containment.