1What is telemetry
automated continuous collection and transmission of real-time data from across an organizations IT infrastrcuture
2What is EDR
Endpoint Detection and Response a cybersecurity technology that continuously monitors end devices and provides deep level inspection
3What is the effectiveness of EDR dependant on
It's dependent on the sensors, configuration and supported events
4What's the core difference between an Antivirus and EDR
Antivirus provides static based signature dection while an EDR continuously monitors endpoint behaviors and uses behavioral, machine learning, and anomaly detection to track patterns
5What are agent deployed in EDR and what kind of details do they record about events
They are deployed on endpoints and send info like timestamps, hostnames, current process, parent process , cmmand line info
6Function of Agents -> EDR Backend Console ->
Agent: Monitors actiity and collects even information
EDR Backend: Receives, telemetry, correlates events to form a story and perform threat analytrics to determine if a sequence is suspicious
EDR Console : Console presents the findings
7EDR backend is the brain connecting the dots. What does that mean
It means that the system connects related events together to form a detection alert.
8What does the SOC analyst do after receiving a detection? What does EDR do to help the process?
The SOC analyst needs to acknowledge the alert and prioritize it.
EDR will often present the detection event with a CVSS score
9Give examples of telemtry collcted by EDR endpoint
Process Executions, Network connections, command line activity, file and folder modifcations registry modications
10What are registries give 2 examples
built in hierarchical database that store configurations settings
hardware and software settings
11Give 4 detection techniques
Behavioral, Anamoly, Mitre Attack Mapping, Machine Learning
12Give 3 manual responses for EDR's
Isolate Host, Remote Access into it, Terminate the process
13Why SIEM?
It provides a centralized solution to aggregating logs from multiple sources, correlating them, detecting malicious activies , and presenting them in a consistent format
14Give me example Log Sources for SIEM
Windows Sysmon, Linux var/log, Web Servers, EDR consoles,
15How do SIEM agents send logs to SIEM dahsboard gimme the flow
Endpoint + SIEM agent -> TLS transport -> SIEM backend -> API -> SIEM Dashboard
16Let's say an alert turns out to be a false positive what should you aim to be doing
Fine tuning the detection rule
17How is Syslog used with SIEM also what is it's port ?
It works well with ingesting Network Hardware logs because routers, switches, and firewalls don't use software agent
UDP/514