medium10 pts · first answer countsincident-reportingthreat-intelligence

Why analysts defang URLs

Why do analysts write indicators like hxxps://evil[.]example[.]com in tickets and reports?

A.It makes the URL load faster in a sandboxB.It is required by the HTTP standardC.It hides the URL from the SIEM so it is not indexedD.It stops the link from being clickable or auto-fetched by email and chat tools, preventing accidental visits

Discussion 0

Join free to post in the discussion.

Why analysts defang URLs

Discussion 0

Related questions