You are building detection for a cloud-first company with a limited SIEM budget. Which log sources do you onboard first and why?
What the interviewer wants to hear
- Prioritise by threat model and detection value per cost
- Identity logs and cloud control plane audit logs first
- EDR telemetry and email security
- Filter or tier high-volume, low-value logs
- Map sources to ATT&CK coverage and review regularly
Model answer
I start from the threat model. For a cloud-first company, most attacks begin with identity, so Entra ID or Okta sign-in and audit logs come first, along with cloud control plane logs like AWS CloudTrail or Azure Activity logs. These are fairly low volume and high value. Next is EDR telemetry, which many EDRs keep in their own console, so I forward only alerts and key events to the SIEM. Email security and SaaS audit logs, such as Microsoft 365, follow because phishing and data theft happen there. High-volume sources like VPC flow logs, DNS and proxy logs are valuable for hunting, so I send them to cheaper storage tiers or data lakes and query them on demand. I map each source to ATT&CK techniques it helps detect and review cost against value every quarter.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Cybersecurity Analyst questions
- Ransomware is spreading across your network on a Friday night. Walk me through how you would handle it.
- Design a threat hunt to find lateral movement in a Windows Active Directory environment.
- Your CISO wants to move to zero trust. What does that mean in practice and where would you start?
- A developer accidentally pushed AWS access keys to a public GitHub repository two hours ago. How do you respond?
- How would you build, test and maintain a new detection rule, for example for credential dumping from LSASS?
- Several employees fell for an adversary-in-the-middle phishing site that stole their session cookies despite MFA. How do you respond and harden the environment?
- HR tells you an engineer who just resigned may be taking source code and customer data. How do you investigate fairly and legally?
- A production Linux server is suspected to be compromised and may lead to legal action. How do you collect evidence in a forensically sound way while limiting business impact?
- How would you measure whether a SOC is effective? Which metrics would you use, and what are their pitfalls?