Domain1 (part one)

What is a system vs. an endpoint vs. a network device?

System = any individual device (PC, server, phone, IoT)
Endpoint = a device connected to a network
Network devices = Routers, switches, that mainly move data between systems

What is log ingestion?

Collecting logs from servers, apps, firewalls, endpoints, and network devices into one place for centralized analysis

Why are logs central to SIEM and EDR? 

They let analysts spot suspicious activity, investigate incidents, and reconstruct attack timelines. 

What does log configuration involve? 

Deploying and managing agents/forwarders that collect and send logs to a central platform, with accurate collection, consistent formatting, and appropriate verbosity

How should logging verbosity differ between critical and less critical systems?

Critical systems = more detailed logging

Less critical systems = reduced verbosity to save storage and processing

What problems can misconfigured logging cause? 

Excessive false positives, missing information, and inconsistent data that complicates investigations

What is log integrity?

Assurance that recorded events stay accurate, complete, and protected from unauthorized modification

How can you detect log tampering? 

Use cryptographic hashes or hash chaining, then compare the previously recorded hash to the current hash

A hash comparison on a log file shows a mismatch. What does that tell you?

The data was altered, but it does not by itself prove malicious tampering

What is hash chaining?

Each record/block stores data plus the hash of the previous one, so any change to history is detectable (blockchain is the example).

Why does time synchronization matter for logs? 

Consistent timestamps across systems let analysts correlate events and build an accurate attack timeline

What do NTP and UTC do for log analysis?

NTP (Network Time Protocol) synchronizes system clocks

UTC (Coordinated Universal Time) is the standard reference across time zones

What determines how long logs are retained?

Organizational policy, operational requirements, and legal/regulatory obligations

Why does log retention matter?

Keeps historical evidence available for investigations, incident response, compliance audits, and forensics

What is a SIEM? (Security Information and Event Management)

A system that collects, normalizes, and correlates security data from many sources and shows it in centralized, human-readable dashboards

What data sources can a SIEM pull from? 

System logs, security alerts, asset inventories, configuration info, network maps, business processes, and geographically distributed locations

What do SIEM dashboards let analysts do that raw logs do not? 

Spot trends, filter events, correlate suspicious activity, and prioritize threats without reviewing entries one by one, while raw logs stay available for deep dives

How should you prioritize security events? 

Investigate high-severity first (Emergency/Critical), while weighing asset importance, threat context, and business 

What is a false positive?

Legitimate activity incorrectly flagged as suspicious or malicious

What is a false negative?

Malicious activity that goes undetected (the tool says it's safe, but it isn't)

What causes excessive false positives in a SIEM?

Improper log configuration, poorly tuned detection rules, or incorrect SIEM settings

What do excessive false positives lead to, and what fixes them?

More analyst workload and alert fatigue. Fix: proper configuration and continuous rule/alert tuning

AI in the SOC: what are the benefits and the caveat?

Improves detection, automates repetitive tasks, speeds response. Human oversight is still essential.