Question

A technology firm's network security specialist notices a sudden increase in unidentified activities on the firm's Security Information and Event and Management (SIEM) incident tracking system. An unknown entity or process also increases the number of reported incidents. The specialist decides to investigate these incidents. Which combination of data sources would provide a balanced perspective to support the investigation?

a.Gateway logs, which track incoming and outgoing network traffic; network interactions monitored by intrusion detection systems (IDS), which detect unauthorized activities; and logs from server OS components.
b.System-specific security logs, which track system-level operations; logs generated by applications running on hosts; and real-time reports from the SIEM solution, summarizing incidents.c
c.User activity logs, which record user behaviors; daily summary reports from the SIEM solution; and high-level network overviews, providing a broad view of network activities.
d.Logs from vulnerability assessment tools, which identify potential weaknesses; transaction logs from databases, tracking changes; and logs from mobile devices, recording device activities.

Answer 1

To investigate unidentified activities in a technology firm's SIEM system, a network security specialist should review gateway logs, IDS logs, and server OS component logs for comprehensive insights into potential security incidents.

Step-by-step explanation:

To support the investigation of the sudden increase in unidentified activities reported by a Security Information and Event Management (SIEM) incident tracking system, a network security specialist should examine a combination of data sources that provide a balanced perspective. The combination that would serve best includes:

• Gateway logs, which track incoming and outgoing network traffic.
• Network interactions monitored by intrusion detection systems (IDS), which detect unauthorized activities.
• Logs from server OS components, detailing system interactions and anomalies.

This collection of data sources integrates information from the edge of the network with internal server events, offering comprehensive insights into potential security incidents. Gateway logs reveal traffic patterns that may signal reconnaissance or data exfiltration attempts. IDS logs provide evidence of intrusion attempts or abnormal network behavior, and server OS logs pinpoint system-level operations that could indicate compromise or misuse.