Download
Security_Operations_7.4_Analyst_Exam_Description.pdf
Question :33
Refer to the exhibit.
You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notifi cation system.
A. Increase the trigger count so that it identifi es and reduces the count triggered by a particular group.
B. Disable the custom event handler because it is not working as expected.
C. Decrease the time range that the custom event handler covers during the attack.
D. Increase the log fi eld value so that it looks for more unique fi eld values when it creates the event.
Ans:A
[ add comment ] | permalink | print article | related link |
( 3.1 / 72 )
Random Entry