312-39V2: Certified SOC Analyst v2

Question

During routine monitoring, the SIEM identifies an unusual increase in outbound data transfer from a critical database server. This server normally generates about 5 MB/hour of outbound traffic, but during the last 10 minutes it has sent more than 500 MB to an external IP address. No predefined signatures match this activity, yet the SIEM generates an alert because the traffic deviates from the server’s normal behavior profile. Which detection method is responsible for this alert?

Explanation

Anomaly-based detection establishes a baseline of normal behavior and alerts when activity significantly departs from that baseline. The drastic increase from approximately 5 MB per hour to more than 500 MB in 10 minutes triggers the alert even without a predefined signature.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ16

Community Discussion