Examkin

Soru

Zorluk: KolayLog Analysis and SIEM Management

A security analyst is examining raw log snippets collected by a SIEM system from various network resources. Match each log entry pattern on the left to the corresponding security event or attack type on the right.

  • 192.168.1.105 - - [27/Jul/2026:14:22:10 +0000] "GET /login.php?user=admin' OR '1'='1" 200 452SQL Injection (SQLi)
  • Jul 27 14:23:01 authserver sshd[4921]: Failed password for root from 10.0.0.45 port 52112 ssh2 (repeated 500 times in 1 minute)SSH Brute Force Attack
  • 192.168.1.50 - - [27/Jul/2026:14:25:30 +0000] "GET /profile.php?name=<script>alert('cookie')</script>" 200 1200Cross-Site Scripting (XSS)
  • Jul 27 14:26:05 firewall filterlog: drop in on em0 proto TCP from 192.168.1.200 to 10.0.0.15 across destination ports 1 through 1024Port Scan / Reconnaissance

Cevap

The HTTP GET request with SQL syntax matches SQL Injection; the repeated SSH authentication failures match SSH Brute Force; the script tag payload matches Cross-Site Scripting; and the sequential port connections match Port Scan / Reconnaissance.
Each log snippet exhibits explicit operational indicators: SQL control characters indicate SQL Injection, high-frequency authentication failures indicate SSH Brute Force, client-side script tags indicate XSS, and sequential port sweep drops indicate a network Port Scan.

Adım Adım Çözüm

1
Analyze web server request parameters in the first log entry
Identified the payload ' OR '1'='1 which manipulates database query logic.
This is a classic signature of SQL Injection.
2
Evaluate authentication log rates in the second entry
Identified 500 failed root login attempts via SSH within 60 seconds.
Rapid repetitive authentication failures indicate password brute forcing.
3
Inspect input strings in the third log entry
Found inline client-side code execution tags (<script>).
Injecting client-side script elements into URL parameters is indicative of XSS.
4
Review firewall drop event patterns in the fourth entry
Observed connections dropped across a broad range of consecutive ports (1-1024).
Probing multiple sequential ports identifies host service reconnaissance.

Anahtar Kavram

Log Pattern Analysis and Threat Identification
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru