When Writing Custom Correlation Rules, the Analyst Should Focus on

question 57

Multiple Choice

When writing custom correlation rules, the analyst should focus on

• A) multiple security controls and events specific to the environment.
• B) any one specific high-quality indicator of compromise.
• C) malware alerts announced by industry security groups.
• D) firewall events, as they provide the first indication of a compromise.

---

Definitions:

Remove Hyperlink

The action of deleting a link embedded in a document or webpage, which typically directs users to another document or website when clicked.

Clear Contents

The action of removing or deleting the information within a selected area, leaving the area empty but intact.

Auto Outline

A feature in spreadsheet software like Microsoft Excel that automatically creates an outline of your data based on formulas, grouping data together for easy analysis and summary.

Group Worksheet Data

The process of summarizing or organizing similar data within different rows or columns in a spreadsheet for analysis.