Security Event Triage

  1. Key Data Sources for Triage
    1. Network-Based Sources
      1. Intrusion Detection/Prevention Systems (IDS/IPS)
        1. Signature-Based Alerts
          1. Anomaly-Based Alerts
          2. Firewall Logs
            1. Allow and Deny Events
              1. Rule Matching
              2. Web Application Firewall (WAF) Logs
                1. Application Layer Attacks
                  1. Blocked Requests
                  2. NetFlow and Packet Captures (PCAP)
                    1. Flow Analysis
                      1. Deep Packet Inspection
                      2. DNS Logs
                        1. Domain Lookup Patterns
                          1. Suspicious Domain Detection
                          2. Proxy Logs
                            1. Web Access Patterns
                              1. Blocked URL Attempts
                            2. Host-Based Sources
                              1. Endpoint Detection and Response (EDR)
                                1. Process Monitoring
                                  1. File Integrity Monitoring
                                  2. Antivirus/Antimalware Alerts
                                    1. Malware Detection Events
                                      1. Quarantine Actions
                                      2. Host-based Intrusion Detection Systems (HIDS)
                                        1. File and Registry Monitoring
                                          1. Policy Violation Detection
                                          2. Operating System Logs
                                            1. Windows Event Logs
                                              1. Security Events
                                                1. System Events
                                                  1. Application Events
                                                  2. Linux Syslog
                                                    1. Authentication Logs
                                                      1. System Activity Logs
                                                        1. Kernel Messages
                                                      2. Application Logs
                                                        1. Web Server Logs
                                                          1. Database Logs
                                                            1. Custom Application Logs
                                                          2. Cloud and Identity Sources
                                                            1. Cloud Security Posture Management (CSPM)
                                                              1. Misconfiguration Detection
                                                                1. Compliance Monitoring
                                                                2. Cloud Access Security Broker (CASB)
                                                                  1. Cloud Application Usage
                                                                    1. Data Movement Monitoring
                                                                    2. Identity and Access Management (IAM) Logs
                                                                      1. Authentication Events
                                                                        1. Privilege Changes
                                                                        2. Single Sign-On (SSO) Logs
                                                                          1. Login Success and Failure
                                                                            1. Federation Events
                                                                          2. Other Sources
                                                                            1. Email Security Gateway Logs
                                                                              1. Spam and Phishing Detection
                                                                                1. Attachment Scanning
                                                                                2. Data Loss Prevention (DLP) Alerts
                                                                                  1. Sensitive Data Movement
                                                                                    1. Policy Violations
                                                                                    2. Threat Intelligence Platforms (TIP)
                                                                                      1. Aggregated Threat Data
                                                                                        1. IOC Management

                                                                                    Previous

                                                                                    2. The Triage Workflow

                                                                                    Go to top

                                                                                    Next

                                                                                    4. Core Triage Analysis Techniques