Cybersecurity Analyst
SIEM and alert triage questions
32 questions on SIEM and alert triage for cybersecurity analysts, easiest first.
Easy 7
Medium 11
- Failed logons followed by successmedium
- Suspicious process tree in EDRmedium
- Spot the attack in a web logmedium
- Reading the logon typemedium
- Splunk query for failed logonsmedium
- KQL for failed Entra sign-insmedium
- Triage an impossible travel alertmedium
- Security log cleared on a servermedium
- A suspicious scheduled taskmedium
- What EDR host isolation doesmedium
- File integrity alert on a web servermedium
Hard 14
- Detecting Kerberoastinghard
- Why a 99% accurate rule floods the SOChard
- Artefacts of PsExec lateral movementhard
- First move on an encrypting hosthard
- Detecting DCSynchard
- Why the JNDI rule missed attackshard
- DNS logs went quiethard
- An impossible timelinehard
- A living-off-the-land downloadhard
- Detecting AS-REP roastinghard
- Suspicious access to LSASShard
- Why honeytokens are high fidelityhard
- Web server spawning a shellhard
- rundll32 with no argumentshard