Which technique would a threat actor use to disguise traces of an ongoing exploit? Explanation: The Network Time Protocol (NTP) uses a hierarchy of time sources to provide a consistent…
Explanation: Packet filtering ACLs use rules to filter incoming and outgoing traffic. These rules are defined by specifying IP addresses, port numbers, and protocols to be matched. Threat actors can…
Explanation: OSSEC is a host-based intrusion detection system (HIDS) that is integrated into Security Onion and actively monitors host system operation.
Explanation: Suricata is a NIDS tool that uses a signature-based approach. It also uses native multithreading, which allows the distribution of packet stream processing across multiple processor cores.
Explanation: Kibana is an interactive dashboard interface to Elasticsearch data. It allows querying of NSM data and provides flexible visualizations of that data. It provides data exploration and machine learning…
Explanation: PulledPork is a rule management utility included with Security Onion to automatically download rules for Snort.
Explanation: Integrated into the Security Onion, OSSEC is a host-based intrusion detection system (HIDS) that can conduct file integrity monitoring, local log monitoring, system process monitoring, and rootkit detection.
Explanation: A benign event should not trigger an alert.
true positive true negative false positive false negative
Explanation: A false alert has no incidents reported, however an exploit has occurred.