What does SIEM stand for and what is its primary function?
SIEM stands for Security Information and Event Management. It collects, centralizes, and analyzes security event data across an organization in real time, enabling fast detection, investigation, and response to threats.
Source: splunk.com
Name common SIEM platforms used in security operations.
Common SIEM platforms include:
* Splunk
* IBM QRadar
* Microsoft Sentinel (formerly Azure Sentinel)
* Google Chronicle
* Others
Source: nttdata.jobs
What is Splunk used for in a SOC?
Splunk is a popular SIEM/log analysis tool that ingests and indexes machine data (logs) from across the network, allowing analysts to search and visualize security events, detect anomalies, and generate alerts.
Source: splunk.com, nttdata.jobs
What is IBM QRadar?
IBM QRadar is a SIEM solution that collects and correlates logs and network events to identify security incidents by matching patterns across data sources, similar to other SIEMs.
Source: nttdata.jobs
What is Microsoft Sentinel?
Microsoft Sentinel is a cloud-native SIEM by Microsoft that gathers security data from on-premises and cloud sources and applies analytics to detect threats.
Source: nttdata.jobs
What does it mean to ‘normalize logs’ in a SIEM?
Normalizing logs means converting log data from different sources into a standard format to ensure uniform fields and structure across diverse log sources, enabling centralized analysis and correlation.
Source: nttdata.jobs
Why is TCP/IP network traffic analysis important for SOC analysts?
TCP/IP network traffic analysis is crucial because many attacks manifest as unusual patterns in network traffic, and analysts must understand TCP/IP flows to spot intrusion attempts and data exfiltration.
Source: nttdata.jobs
Name some SIEM query languages.
Common SIEM query languages include:
* Splunk’s SPL (Search Processing Language)
* Azure Sentinel’s KQL (Kusto Query Language)
* IBM QRadar’s AQL (Ariel Query Language)
Source: nttdata.jobs
How do SIEM systems support compliance and auditing?
SIEMs support compliance and auditing by centralizing log retention and providing built-in reporting dashboards, helping organizations meet audit and compliance requirements.
Source: splunk.com
How do SOC analysts use log data to detect incidents?
SOC analysts continuously monitor and analyze log data from various sources to identify anomalies, triaging alerts and correlating log events to detect and investigate potential security incidents.
Source: nttdata.jobs
What is the MITRE ATT&CK framework?
MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on real-world observations, classifying how attackers operate across stages of an intrusion to help SOCs understand and anticipate attacks.
Source: paloaltonetworks.co.uk, en.wikipedia.org
In ATT&CK, what do ‘tactics’ and ‘techniques’ mean?
‘Tactics’ refer to an adversary’s technical objectives (the ‘why’ of an attack), while ‘techniques’ are specific actions used to achieve those objectives.
Source: en.wikipedia.org
How many tactics are in the ATT&CK Enterprise matrix? Name a few.
There are 14 tactics in the Enterprise matrix. Examples include:
* Reconnaissance
* Initial Access
* Persistence
* Privilege Escalation
* Defense Evasion
* Credential Access
* Lateral Movement
* Command and Control
* Exfiltration
* Impact
Source: en.wikipedia.org
Why do SOC teams use the MITRE ATT&CK framework?
SOC teams use ATT&CK to map observed alerts and incidents to known attacker behaviors, helping identify gaps in detection and design defenses aligned with real adversary operations.
Source: paloaltonetworks.co.uk
How is ATT&CK different from the Cyber Kill Chain?
The Kill Chain describes stages of an attack, while MITRE ATT&CK provides a detailed matrix of tactics and techniques covering all attack phases, especially post-compromise behavior, making it more granular and behavior-focused.
Source: en.wikipedia.org
Give an example of a MITRE ATT&CK tactic and a technique under it.
An example is ‘Privilege Escalation’ as a tactic and ‘Credential Dumping’ as a technique, which involves extracting credentials to gain higher access.
Source: en.wikipedia.org
What is the ‘Initial Access’ tactic in MITRE ATT&CK?
‘Initial Access’ covers techniques used to gain an initial foothold in a network, such as phishing or exploiting a public-facing application.
Source: en.wikipedia.org
What is the ‘Lateral Movement’ tactic in MITRE ATT&CK?
‘Lateral Movement’ refers to techniques adversaries use to move within a network after initial compromise, like using stolen credentials to log into other systems.
Source: en.wikipedia.org
What is threat intelligence?
Threat intelligence is evidence-based knowledge about cyber threats and adversaries, including context, tools, and behavior, used to turn threat data into actionable insights for security decisions.
Source: crowdstrike.com, socprime.com
What are Indicators of Compromise (IOCs)?
IOCs are forensic artifacts that signal a breach, such as known malicious IP addresses, domain names, URLs, or file hashes, used by SOCs to detect and block known threats quickly.
Source: crowdstrike.com
How do SOC analysts use threat intelligence?
SOC analysts integrate intel feeds (IOCs, TTPs) into monitoring tools, enriching SIEM alerts with IOCs to confirm incidents or update rules, often collaborating with threat intel teams to improve detection logic.
Source: nttdata.jobs, crowdstrike.com
What’s the difference between tactical and strategic threat intelligence?
Tactical intel focuses on immediate technical details for active defenses, while strategic intel provides high-level insights to inform long-term strategy.
Source: crowdstrike.com
What is a threat intelligence feed?
A threat intelligence feed is an automated stream of threat data, usually IOCs like malicious IPs or file hashes, that SOC tools ingest to update blocklists and detection rules in near real time.
Source: crowdstrike.com
What is threat hunting?
Threat hunting is the proactive search for hidden threats in the environment, where analysts use threat intelligence and hypotheses to comb through logs and identify malicious activity that automated systems may have missed.
Source: nttdata.jobs, crowdstrike.com
