SOC tiers, SIEM correlation, log sources, EDR, threat intelligence feeds, indicators of compromise and hunting hypotheses.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What are the primary responsibilities of a SOC Tier 1 analyst?
Show answer
Alert triage, initial investigation, ticket documentation, and escalation decisions- What is the main role of a SOC Tier 2 analyst?
Show answer
Deeper incident analysis, threat research, and containment recommendations- What responsibilities does a SOC Tier 3 analyst handle?
Show answer
Threat hunting, threat intelligence, tool development, and team mentoring- What does SIEM stand for and do?
Show answer
Security Information and Event Management; aggregates, correlates and analyzes security logs in real time- What is a SIEM correlation rule?
Show answer
A condition or pattern that triggers an alert when multiple log events match specified criteria within a timeframe- What does SIEM log normalization accomplish?
Show answer
Converts different log formats into a common schema so events from different sources can be compared and correlated- What is a false positive in SIEM alerting?
Show answer
An alert generated when no actual security incident has occurred, creating noise and alert fatigue- How are SIEM alerting thresholds tuned?
Show answer
Based on event frequency, severity rating, time windows, and business risk tolerance to balance detection and noise- What information do firewall logs record?
Show answer
Blocked and allowed connections, source and destination IPs, ports, protocols, and action taken- What does a network IDS log typically show?
Show answer
Detected intrusion attempts, rule violations, malicious signatures, threat severity and packet details- What content appears in web server logs?
Show answer
HTTP methods, request URIs, status codes, user agents, response sizes, timestamps and client IPs- What does a database audit log capture?
Show answer
Login attempts, SQL queries executed, data accessed or modified, schema changes and timestamp information- What do Windows Authentication logs (Event ID 4624, 4625) record?
Show answer
Successful and failed login attempts, logon types, account names, source IPs and privilege elevation events- What information is captured in DNS query logs?
Show answer
Domain names queried, resolved IP addresses, query types, response codes and client source- What do proxy server logs typically contain?
Show answer
HTTP requests, URLs accessed, content categories, bandwidth used, user identities and block actions
FlashKeepers