An analyst receives an automated intrusion detection alert indicating suspicious outbound traffic from a workstation. Place the initial network security monitoring and triage steps in the correct chronological order from first to last.
- 1Validate the initial network alert to verify whether it represents a real security event or a false positive.
- 2Examine relevant packet captures and netflow logs to determine the scope and nature of the network activity.
- 3Isolate the affected workstation from the network to prevent potential lateral movement or data exfiltration.
- 4Document the monitoring findings and notify the incident response team for escalation.
Cevap
The correct sequence is: First, validate the initial network alert to verify whether it represents a real event or false positive; second, examine relevant packet captures and netflow logs to determine the scope; third, isolate the affected workstation from the network; fourth, document the monitoring findings and notify the incident response team.
Effective network security monitoring follows a structured workflow: alert triage and validation must happen first, followed by telemetry inspection to scope the incident, host isolation to contain risk, and finally thorough documentation and incident escalation.
Adım Adım Çözüm
Anahtar Kavram
Network Security Monitoring Triage & Incident Workflow