Explanation: Integrated into the Security Onion, OSSEC is a host-based intrusion detection system (HIDS) that can conduct file integrity monitoring, local log monitoring, system process monitoring, and rootkit detection.
Explanation: A benign event should not trigger an alert.
true positive true negative false positive false negative
Explanation: A false alert has no incidents reported, however an exploit has occurred.
Explanation: A positive alert happens when an alert is received, but no incident has occurred.
Explanation: A true alert occurs when no incidents are reported and no incidents have occurred.
Explanation: NetFlow does not capture the entire contents of a packet. Instead, NetFlow collects metadata, or data about the flow, not the flow data itself. NetFlow information can be viewed…
Explanation: The tcpdump command line tool is a packet analyzer that captures detailed packet protocol and content data. It can display packet captures in real time or write them to…
Explanation: AVC uses Cisco Next-Generation Network-Based Application Recognition (NBAR2) to discover and classify the applications in use on the network.
Explanation: Security Information and Event Management (SIEM) is a technology that provides real-time reporting and long-term analysis of security events. Two SIEM platforms used by organizations are Splunk and Security…