CompTIA · CySA+ CS0-004
Detection, analysis, and triage
CySA+ CS0-004 · Lesson 19 of 22 · 2:43:40
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: log collection with synchronized clocks, correlation, enrichment, alerts and notifications, alert fatigue and tuning, triage, a timeline in one time zone, and severity, functional and information impact, recoverability, and prioritization. Includes three original practice questions.
Preview the topics
- The SIEM sees fifty failed sign-ins on different accounts from one address within ten minutes, then a successful sign-in, and it raises a single alert for password spraying. Which technique produced this alert?
- The firewall logs use UTC, the mail server logs use Eastern time, and the EDR uses the local time of each laptop. Before building the timeline, what should the analyst do first?
- Two incidents are confirmed at once: malware on a lobby kiosk with no access to member data, and a suspicious sign-in on the administrator account of the payment server. The team can only work on one right now. Which one comes first?