A Security Operations Center (SOC) analyst receives an automated high-severity SIEM alert indicating suspicious outbound traffic from an internal database server containing sensitive customer records to an unknown external IP address over port 443. The analyst must follow network security monitoring and initial incident response procedures. In what chronological sequence should the analyst execute the following triage and containment actions?
- 1Analyze NetFlow records and SIEM log correlations to verify session volume, duration, and communication endpoints.
- 2Inspect Network Intrusion Detection System (NIDS) alerts and full packet captures (PCAP) to check for signatures and indicators of compromise (IoCs).
- 3Apply network isolation controls to the affected database host to prevent data exfiltration while preserving system memory state.
- 4Update perimeter firewall rules to block the external destination IP address across the enterprise boundary.
Cevap
The correct order of actions begins with analyzing NetFlow records and SIEM log correlations, followed by inspecting NIDS alerts and full packet captures (PCAP), then applying network isolation controls to the database host, and finally updating perimeter firewall rules to block the external destination IP address.
The triage process follows a logical sequence from high-level flow verification to payload inspection, host isolation, and perimeter defense. Flow telemetry (NetFlow/SIEM) is evaluated first to confirm the alert boundaries. NIDS alerts and PCAP files are then examined to identify IoCs and malicious payloads. Next, host containment stops active data exfiltration while preserving volatile evidence. Finally, blocking the external malicious IP at the perimeter safeguards the broader enterprise architecture.
Adım Adım Çözüm
Anahtar Kavram
Incident Response and Triage Workflow in Network Security Monitoring