8.2.2. Identification

Try these first

1. 1.

   What does SIEM stand for?

   Hint

   Think of a system managing security events.

2. 2.

   Which tool can alert us to suspicious activity?

   Hint

   Recall the systems used to monitor traffic.

3. 3.

   What is the main goal of the Identification phase in incident response?

   • Detect suspicious activities
   • Respond to incidents
   • Prepare resources

   Hint

   Consider the first steps in an incident response process.

4. 4.

   True or False: Verification is necessary to confirm if an incident is real and requires action.

   • True
   • False

   Hint

   Think about how critical accurate detection is in incident response.

5. 5.

   Discuss the implications of a false positive in the identification phase for a large organization's operations.

   Hint

   Consider how often alerts could pull the team away from critical tasks.

6. 6.

   Create a step-by-step verification strategy for anomalous activities detected in a network environment.

   Hint

   Think through the necessary actions from detection to confirmation.