XSIAM-Engineer日本語参考質問2：A cybersecurity analyst consistently searches for suspicious activity involving the 'System' user on

<<前へ次へ>>

質問 2/73

A cybersecurity analyst consistently searches for suspicious activity involving the 'System' user on Windows endpoints. However, logs from different Windows versions or agents report the 'System' user as 'NT AUTHORITY\SYSTEM', 'SYSTEM', or 'S-1-5-18'. This inconsistency hinders effective searching. To optimize content for this specific use case within XSIAM, which data modeling rule should the engineer prioritize?

A. An 'extraction rule' to parse the full user string and always extract the SID (S-l -5-18) into a dedicated 'user_sid' field. B. A 'mapping rule' that normalizes any recognized variant of 'System' user (e.g., 'NT AUTHORITY\SYSTEM', 'SYSTEM') to a consistent value like 'SYSTEM ACCOUNT' in a new 'normalized user field. C. An 'enrichment rule' that queries an external identity management system to resolve all user SIDS to their canonical usernames. D. A 'filtering rule' that drops events where the user is identified as 'S-l -5-18' to reduce noise. E. A 'correlation rule' that combines events from different user representations into a single alert.

質問 2/73

コメントを発表する

Download PDF File