SIEM and alert triage
32 practice items · needed by 1 role
Easy 7Medium 11Hard 14
Practice questions
- What is Windows Event ID 4625?easy
- What is Windows Event ID 4624?easy
- IOC vs IOAeasy
- False positive or false negative?easy
- What is Sysmon Event ID 1?easy
- Brute force or password spraying?easy
- What a Tier 1 SOC analyst doeseasy
- Failed logons followed by successmedium
- Suspicious process tree in EDRmedium
- Spot the attack in a web logmedium
- Reading the logon typemedium
- Splunk query for failed logonsmedium
- KQL for failed Entra sign-insmedium
- Triage an impossible travel alertmedium
- Security log cleared on a servermedium
- A suspicious scheduled taskmedium
- What EDR host isolation doesmedium
- File integrity alert on a web servermedium
- Detecting Kerberoastinghard
- Why a 99% accurate rule floods the SOChard
- Artefacts of PsExec lateral movementhard
- First move on an encrypting hosthard
- Detecting DCSynchard
- Why the JNDI rule missed attackshard
- DNS logs went quiethard
- An impossible timelinehard
- A living-off-the-land downloadhard
- Detecting AS-REP roastinghard
- Suspicious access to LSASShard
- Why honeytokens are high fidelityhard
- Web server spawning a shellhard
- rundll32 with no argumentshard