312-39V2: Certified SOC Analyst v2

Question

A security team is developing SIEM use-case logic to identify privilege-escalation attempts on Windows servers. They have already identified and validated the required event sources (for example, Active Directory logs and Windows Security logs). What should be the next step in the use-case logic development process?

Explanation

After validating the necessary telemetry sources, the use case must define correlation rules and conditions that recognize the relevant privilege-escalation behaviors. This creates the detection logic that can subsequently be tested, tuned, and deployed.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ38

Community Discussion