Activity App Flashcards by Rachelle Wolff

Q

Known bad files

A

Detections

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Behaviorally suspicious activity

A

Detections

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Prevented actions

A

Detections

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Blocklisted hashes

A

Detections

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Manual detections

A

Detections

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

In progress

A

Detection status option

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

True positive

A

Detections status option

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

False positive

A

Detections status option

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Ignored

A

Detections status option

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

Steps to assign a detection

A

Select checkbox
Update & assign
Select assign to and Set Status
Update

How well did you know this?

1

Not at all

2

3

4

5

Perfectly

Q

What is included in an incident?

A

Detections
Associated processes
Connections between detections and associated processes
Tactics & Techniques involved
Killed or blocked activities
Hosts/users involved
Whether the attack is active
Timeline
Incident status

How well did you know this?

1

Not at all

2

3

4

5

Perfectly