CompTIA · CySA+ CS0-004
Threat intelligence, endpoint, and file analysis tools
CySA+ CS0-004 · Lesson 7 of 22 · 57:32
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: threat intelligence platforms like OTX, MISP, and OpenCTI, EDR, XDR, and mobile device management, WHOIS and RDAP, AbuseIPDB, and IP geolocation, the strings command, hash searches on VirusTotal, YARA rules, and sandboxes like Joe Sandbox and Cuckoo3. Includes three original practice questions.
Preview the topics
- A malicious attachment was opened on one teller laptop, and the SOC must stop it from talking to other devices, while keeping it powered on for analysis. What should the analyst do?
- To find out whether the attachment belongs to a known malware family, an analyst writes a pattern that matches three unique strings found in it, and scans every endpoint with it. Which tool is this?
- Before uploading a suspicious contract file from a customer to an online scanner, the analyst remembers that the file may contain personal data. What should the analyst do first?