Professional Security Operations EngineerDemo

Question

You are responsible for identifying suspicious activity and security events across your organization's environment. You find that certain detection rules are triggering for internal IP addresses in the 192.0.2.0/8 subnet, causing false-positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?

A net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
B net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")
C not net.ip_in_range_cidr(all Se.principal.ip, "192.0.2.0/8")
D not net.ip_in_range_cidr(any Se.principal.ip, "192.0.2.0/8")

Explanation

net.ip_in_range_cidr() returns true when an IP address is in the specified CIDR range. Applying any to the repeated principal.ip field makes the expression true if at least one principal IP is within that range; negating it prevents detections for events containing those internal IP addresses, reducing the false positives.

Learn more

Professional Security Operations EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ27

Community Discussion