Cybersecurity Analyst
SIEM and alert triage questions
206 questions on SIEM and alert triage for cybersecurity analysts, easiest first.
Easy 67
- What is Windows Event ID 4625?easy
- What is Windows Event ID 4624?easy
- IOC vs IOAeasy
- False positive or false negative?easy
- What is Sysmon Event ID 1?easy
- Brute force or password spraying?easy
- What a Tier 1 SOC analyst doeseasy
- Windows event for an account lockouteasy
- Windows event for a new serviceeasy
- Sysmon Event ID 13easy
- Sysmon Event ID 3easy
- Missing command lines in 4688easy
- What a benign true positive iseasy
- What stats count by does in SPLeasy
- Grouping with summarize in KQLeasy
- EDR compared with antiviruseasy
- Why logs go to a SIEMeasy
- Why normalise to a common schemaeasy
- Windows event for a new accounteasy
- A user added to Domain Adminseasy
- Sysmon Event ID 11easy
- Sysmon Event ID 22easy
- Why Sysmon needs a config fileeasy
- Collecting Windows logs with WEFeasy
- Windows event for a failed logoneasy
- Event for a locked-out accounteasy
- Event for a new user accounteasy
- Event for a failed Kerberos pre-autheasy
- Security log was wipedeasy
- What a honeypot is foreasy
- What a SIEM is foreasy
- What a Splunk index iseasy
- What sourcetype tells Splunkeasy
- The Splunk Universal Forwardereasy
- Default port for classic syslogeasy
- The risk of alert fatigueeasy
- What SOAR adds to a SIEMeasy
- Alert or incident?easy
- What EPS means for a SIEMeasy
- Hot and cold log storageeasy
- A good escalation noteeasy
- What a correlation rule doeseasy
- Why keep logs for monthseasy
- Why SOCs write playbookseasy
- Searching only the last 24 hourseasy
- Where Sentinel keeps its dataeasy
- What a Sentinel data connector doeseasy
- What a Sentinel analytics rule doeseasy
- Filtering the last hour in KQLeasy
- What project does in KQLeasy
- What take 10 returnseasy
- The table for Windows security eventseasy
- ResultType 0 in sign-in logseasy
- What a Sentinel watchlist is foreasy
- Automation rule or playbook?easy
- What extend does in KQLeasy
- Counting rows in KQLeasy
- What a Sentinel workbook iseasy
- Default order of sort byeasy
- A sign-in from a Tor exit nodeeasy
- Wazuh agent and manager roleseasy
- What a Wazuh rule level meanseasy
- What Wazuh SCA checkseasy
- What a QRadar offense iseasy
- A useful shift handovereasy
- The Wazuh module for file changeseasy
- Managing Elastic Agents centrallyeasy
Medium 77
- Failed logons followed by successmedium
- Suspicious process tree in EDRmedium
- Spot the attack in a web logmedium
- Reading the logon typemedium
- Splunk query for failed logonsmedium
- KQL for failed Entra sign-insmedium
- Triage an impossible travel alertmedium
- Security log cleared on a servermedium
- A suspicious scheduled taskmedium
- What EDR host isolation doesmedium
- File integrity alert on a web servermedium
- Why pySigma needs a pipelinemedium
- PowerShell Script Block Loggingmedium
- WMI event subscription persistencemedium
- Bucketing time with bin() in KQLmedium
- has vs contains in KQLmedium
- Detecting DLL sideloadingmedium
- Sysmon Event 8, CreateRemoteThreadmedium
- Latest row per device with arg_maxmedium
- Defender protection switched offmedium
- Reading logon type 10medium
- Many type 3 logons from one PCmedium
- What event 4672 tells youmedium
- Alert on new Domain Adminsmedium
- Reading 4625 sub-status codesmedium
- Finding who still uses NTLMmedium
- What logon type 9 meansmedium
- Reading timechart spanmedium
- What dedup user keepsmedium
- Comparing two fields in SPLmedium
- Matching DNS against an IOC listmedium
- Creating a field with evalmedium
- Reading a 4625 sub statusmedium
- What event 4648 recordsmedium
- Where NTLM logons are validatedmedium
- Alerts from the vulnerability scannermedium
- Throttling a repeating alertmedium
- Searching logins across vendorsmedium
- Why *admin* is slowmedium
- Daily volume from EPSmedium
- First checks on a reported phishmedium
- What top showsmedium
- Trusting a GeoIP resultmedium
- Ranking two equal alertsmedium
- Benefit of search-time fieldsmedium
- Closing a false positive wellmedium
- A user added to local Administratorsmedium
- == versus =~ in KQLmedium
- Finding servers with no EDR datamedium
- What let does in KQLmedium
- Pulling a value out with parsemedium
- Expanding an array columnmedium
- Minutes between two eventsmedium
- Listing all IPs per user in KQLmedium
- Matching a list ignoring casemedium
- Checking an IP is in a subnetmedium
- Run frequency and look-back periodmedium
- When to use a near-real-time rulemedium
- Why map entities in a rulemedium
- Grouping alerts into one incidentmedium
- Finding agents that stopped reportingmedium
- Labelling rows with iffmedium
- What UEBA adds in Sentinelmedium
- Error 50053 in sign-in logsmedium
- Mass download from SharePointmedium
- Basic logs versus Analytics logsmedium
- Searching two tables at oncemedium
- What if_sid does in a Wazuh rulemedium
- Frequency and timeframe in Wazuhmedium
- What a Wazuh decoder doesmedium
- Risk of automatic IP blockingmedium
- Reading an EQL sequencemedium
- Reading an ES|QL querymedium
- What drives QRadar magnitudemedium
- How Wazuh finds vulnerable softwaremedium
- Mean or median time to acknowledge?medium
- What ILM does in Elasticsearchmedium
Hard 62
- Detecting Kerberoastinghard
- Why a 99% accurate rule floods the SOChard
- Artefacts of PsExec lateral movementhard
- First move on an encrypting hosthard
- Detecting DCSynchard
- Why the JNDI rule missed attackshard
- DNS logs went quiethard
- An impossible timelinehard
- A living-off-the-land downloadhard
- Detecting AS-REP roastinghard
- Suspicious access to LSASShard
- Why honeytokens are high fidelityhard
- Web server spawning a shellhard
- rundll32 with no argumentshard
- Catching a renamed binaryhard
- Logon type 9 with seclogohard
- An over-broad Sysmon exclusionhard
- Correlation broken by time zoneshard
- How durable is a named pipe rulehard
- Late logs and a 5-minute lookbackhard
- Seasonal anomaly detection in KQLhard
- Catching encryption in progresshard
- An attacker blinding Sysmonhard
- Bring your own vulnerable driverhard
- Sysmon Event 25, process tamperinghard
- A subsearch that silently drops IOCshard
- Keeping events while adding totalshard
- Counting failures in a rowhard
- Every alert arrives twicehard
- Many log lines in one eventhard
- Risk-based alerting thresholdhard
- How many analysts the queue needshard
- Disk for 90 days of Splunk datahard
- What to collect firsthard
- Duplicate events after an outagehard
- Failures that never show as 4625hard
- Replacing a slow transactionhard
- Decoding an -enc commandhard
- Which laptop had that IP?hard
- Events stamped in the pasthard
- The join that lost rowshard
- Hours with no events vanishhard
- Why dcount differs from the exact counthard
- Risky sign-in then mailbox rulehard
- Measuring ingestion delayhard
- Longest look-back for a scheduled rulehard
- Reusing a costly subqueryhard
- Pay-as-you-go or commitment tier?hard
- What the Fusion engine detectshard
- A rule that went quiethard
- Grouping by a nested fieldhard
- Traffic to a three-day-old domainhard
- Querying several workspaces at oncehard
- Comparing a row with the previous onehard
- lookup versus join for enrichmenthard
- Where custom Wazuh rules belonghard
- Exact match fails on a text fieldhard
- Detecting a stopped agenthard
- Firewall logs missing at peak hourshard
- Which event came first?hard
- MTTR fell, but something is offhard
- Changing a built-in Wazuh rulehard