CompTIA · CySA+ CS0-004
Efficiency and process improvement
CySA+ CS0-004 · Lesson 10 of 22 · 1:19:37
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: standard processes, playbooks, and runbooks, SOAR automation and orchestration, infrastructure as code, enrichment, rule tuning with documented changes, dashboards, APIs, webhooks, and plug-ins, and measuring every improvement. Includes three original practice questions.
Preview the topics
- Analysts spend twenty minutes on every phishing report, doing the same lookups by hand: sender reputation, link checks, and a search for the same message in other mailboxes. What would improve efficiency the most?
- The SOC wants new critical SIEM alerts to appear in the team’s chat channel within seconds, without a script that checks for new alerts every five minutes. What should it use?
- A SIEM rule fires 300 times a day on a scheduled backup job that copies files to a known server, and analysts now ignore it. What is the best fix?