Chapter_12_Forwarding

Question 1

What can be forwarded via email?

Answer 1

Only Alerts can be forwarded via email

Question 2

How can other information be forwarded?

Answer 2

Other information (as well as alerts) may be forwarded via Syslog

Question 3

Why might you configure forwarding conditions?

Answer 3

So Alerts get sent not only to the SEIM and SOC, but also to the Operations center managing the OT device

Question 4

What format are Syslog messages sent using? Can the message be edited? If so, how?

Answer 4

CEF, LEEF and JSON(Splunk) are the standard formats, but they can be edited by adding any available tag from the SilentDefense properties database.