Professional Security Operations Engineer

Question

You need to enhance your organization’s existing Security Command Center (SCC) implementation with additional detectors. You have a list of known IOCs and want to incorporate external signals for this capability to provide broad detection coverage. What should you do?

Explanation

An Event Threat Detection custom module based on the Configurable Bad IP template lets an organization supply and maintain suspicious external IP addresses or CIDR blocks. Event Threat Detection evaluates the relevant logs for connections to those indicators and creates findings, while retaining its built-in detection logic and threat intelligence.

Learn more

Professional Security Operations Engineer

AstroTutor

Notes

Readiness

QuestionQ8

Community Discussion