COMPILED CLASS NOTES

Data Collection
(A) SIEM:
SIEM data collection involves gathering logs and event data from various sources
across an organization's infrastructure, including servers, network devices,
applications, and security systems. This data is then aggregated and analyzed to
identify potential security threats.
Log Collection:
SIEM systems collect logs and event data from various sources.
Data Sources:
These sources include network devices (routers, switches), security intelligence
devices (firewalls, intrusion detection systems), servers, applications, and cloud
services.
Collection Methods:
1. Agents: SIEM agents are deployed on devices to collect logs and event data.
2. Network Protocols: SIEM systems can connect directly to devices using network
protocols or API calls.
3. Syslog: Log files are often collected in Syslog format.
4. Event Streaming: SIEM can receive event data via protocols like SNMP, Netflow,
or IPFIX.

Data Pre-processing:
Some SIEM systems may perform pre-processing at edge collectors, such as filtering
or aggregating data before sending it to a centralized location.
Benefits of Comprehensive Data Collection:
1. Enhanced Security Posture:
By collecting and analyzing data from various sources, SIEM systems can provide a
comprehensive view of an organization's security landscape.
2. Improved Threat Detection: SIEM systems can identify patterns and anomalies in
data that may indicate a security threat.
3. Faster Incident Response: SIEM systems can generate alerts and notifications
when potential threats are detected, allowing security teams to respond quickly.
4. Compliance and Auditing: SIEM systems can help organizations meet
compliance requirements by providing a centralized repository of security-related
information.

(B) Incident Investigation:

Data collection is a crucial step in incident investigations, aiming to gather all relevant
information to understand the incident's context, cause, and potential contributing
factors. This process involves identifying, accessing, and documenting various data
sources, including physical evidence, witness statements, electronic data, and
environmental data.
1. Identify Relevant Data Sources:
Physical Evidence:This includes anything tangible related to the incident, such as
equipment, materials, or the scene itself.
Witness Statements: Interviews with individuals who witnessed or were involved in
the incident are vital for gathering firsthand accounts.
Electronic Data: This encompasses logs, records, videos, and other digital
information relevant to the incident.
Environmental Data: This includes information about the environment where the
incident occurred, such as weather conditions, lighting, and any surrounding hazards.
2. Data Collection Methods:
Interviews: Conducting thorough interviews with witnesses and involved parties to
gather details and perspectives.
Evidence Examination: Carefully examining and documenting any physical
evidence related to the incident.
Record Review: Analyzing relevant documents, logs, reports, and other records to
establish a timeline and context.
Data Extraction: Extracting relevant information from digital sources, such as
databases, email systems, and CCTV recordings.

Data Normalization: Normalization challenges in data collection for SIEM primarily

stem from the diversity and complexity of log formats generated by various devices
and applications. SIEM systems, by their nature, collect data from a wide array of
sources, each with its own unique logging style. This variability in log formats makes
it difficult to create a consistent, structured representation of the data, which is
essential for effective correlation and analysis. Challenges are as follows:
1. Mismatched Parsing Methods: SIEM solutions can use different parsing methods,
leading to discrepancies in log formats, field names, and overall data structure.
2. Difficulty in Standardization: Log data may need to be normalized to a common
format before analysis and correlation. This process can be complex and time-
consuming, especially when dealing with large volumes of data.
3. Data Overload: The sheer volume of data generated by different sources can
overwhelm the SIEM system, making it challenging to effectively process and
analyze the information.
4. Impact on Querying: Normalization can impact querying the data, as it may
require complex joins between tables.

Indicators of Attack (IOA):

 IOAs are proactive indicators that identify potential threats or attacks before they
occur or during the early stages of an attack.
 They help security teams understand the attacker's tactics, techniques, and
procedures (TTPs).
 IOAs can be used to predict and prevent attacks by recognizing suspicious
behaviors or patterns.
 Examples of IOAs include unusual network traffic, suspicious file activity, or
unusual process execution.
Indicators of Compromise (IOC):
 IOCs are evidence of a security incident that has already occurred.
 They provide information about the nature and extent of the compromise, helping
security teams investigate and remediate the breach.
 Examples of IOCs include malicious IP addresses, domain names, file hashes, and
malware signatures.

Compliance

 GDPR (General Data Protection Regulation): Protects personal data and

privacy of EU citizens.
 PCI DSS (Payment Card Industry Data Security Standard): Ensures secure
handling of credit card transactions.
 GLBA (Gramm-Leach-Bliley Act): Requires financial institutions to protect
consumers' private data.
 FISMA (Federal Information Security Management Act): Enforces security
standards for U.S. federal government information systems.
 HITECH (Health Information Technology for Economic and Clinical Health
Act): Promotes secure electronic health records; supports and extends HIPAA.
 HIPAA (Health Insurance Portability and Accountability Act): Sets standards
for protecting sensitive patient health information.
 NIST (National Institute of Standards and Technology):Develops
cybersecurity frameworks and best practices across sectors.

Forensic Analysis

Forensic analysis involves collecting, preserving, analyzing, and presenting

digital evidence to investigate cybercrimes or security incidents. It includes
identifying breaches, tracking intruders, and recovering lost data. Forensic
tools like EnCase and FTK assist in examining hard drives, memory, and
network traffic. Documentation and adherence to legal standards are essential.
Together, forensic analysis and evidence protection ensure reliable findings,
support legal actions, and enhance cybersecurity by learning from incidents
and preventing recurrence.

Different types of logs in Forensic Analysis

1. System Logs
Record core operating system activities like startups, shutdowns, hardware
failures, and system errors. Useful for identifying when a system was accessed,
restarted, or experienced issues.
2. Application Logs
Track specific events within software applications, including user actions,
errors, or configuration changes. Help determine how an application was used
and if it was involved in a security incident.
3. Security Logs
Contain entries on login attempts, user authentication, access violations, and
policy changes. Crucial for detecting unauthorized access, password attacks,
or privilege escalations.
4. Event Logs
Found in Windows systems, these combine system, application, and security
logs. Useful for identifying patterns, tracing actions, and correlating multiple
events during forensic investigations.
5. Firewall Logs
Monitor and record inbound/outbound network traffic based on firewall rules.
Help detect blocked or suspicious connections, unauthorized access attempts,
and data exfiltration.
6. Network Logs
Track data flowing through networks, such as source/destination IPs, ports,
and protocols. Useful for detecting anomalies, lateral movement, and
communications with malicious hosts.
7. Web Server Logs
Record all requests to a web server including IP addresses, accessed URLs,
timestamps, and user agents. Useful for tracing attacks like SQL injection or
DDoS.
8. DNS Logs
Log domain name resolution requests and responses. Help detect suspicious or
unauthorized domain lookups that might indicate malware activity or data
exfiltration via DNS tunneling.
9. Proxy Logs
Capture users’ internet access through proxy servers, including visited URLs
and access times. Useful for monitoring web activity and identifying access to
malicious or restricted sites.
10. Email Logs
Record metadata of email traffic, including sender, recipient, timestamps, and
attachment info. Help investigate phishing attacks, email spoofing, or
unauthorized data sharing.
11. IDS/IPS Logs
Capture real-time alerts on potential threats, such as malware or exploit
attempts. Provide insight into intrusion attempts and can help block attacks or
verify breaches.
12. Access Logs
Track physical or system access events, such as door entry or login attempts.
Essential for verifying who accessed a system or location and when.

Evidence Protection

Evidence protection is crucial to maintain integrity and admissibility in court.

This requires proper chain of custody, secure storage, and use of write
blockers to prevent data alteration.
System imaging plays a critical role in digital evidence collection by ensuring
that all data from a suspect or victim's system is preserved in its original,
unaltered state.

1. Preserves Evidence Integrity: Creates a bit-by-bit replica of a storage

device, including deleted or hidden data. Prevents accidental modification of
original data. Hashing tools like SHA-1, SHA-256, or MD5 are used to
generate cryptographic hashes for both the original and the image to ensure
integrity.

Tools Used:

 md5sum, sha256sum (Linux)

 FTK Imager (GUI-based forensic imaging tool with hash verification)
 EnCase (Comprehensive forensic suite with built-in hashing)
 dcfldd (Enhanced version of dd with hashing support)
 Autopsy (Verifies hashes during image analysis)

2. Enables Safe Forensic Analysis: Investigators work on the image copy,

not the original device. Prevents contamination of evidence, ensuring
repeatable and defensible results.
3. Maintains Legal Chain of Custody: Hash values confirm the image has
not been altered. Detailed logs and timestamps from imaging tools help
maintain an auditable trail.
4. Captures Complete Data: Includes active files, deleted files, unallocated
space, system files, slack space, and partitions.

Access Control: Access control is vital for protecting digital evidence during
forensic investigations. It ensures that only authorized personnel can access,
view, or modify evidence, preserving its integrity and legal admissibility. By
enforcing role-based access, the principle of least privilege, and audit logging,
access control prevents unauthorized changes and maintains a clear chain of
custody. Encryption and secure storage systems further enhance protection.
Tools like FTK Central, EnCase, and Active Directory help manage
permissions effectively. Access logs track who interacted with evidence and
when, supporting accountability. Overall, access control safeguards evidence
from tampering, loss, and insider threats throughout the investigation process.

False Positive: A false positive occurs when benign activity is incorrectly

flagged as a threat, causing wasted resources and alert fatigue.

False Positive: A false negative is more dangerous—real threats go

undetected, leading to potential breaches. To detect and analyze them, security
teams review alerts, compare them against threat intelligence, and validate
them through forensic analysis or behavioral baselines.
Steps to detect and analyze false positives and false negatives:

1. Identify Alerts from Detection Systems:

Collect alerts from security tools like SIEMs, IDS/IPS, antivirus, or EDR and
categorize them based on severity, type, and source.

2. Validate Alerts (Detect False Positives):

 Investigate whether the alert corresponds to real malicious activity.

 Check system logs, user activity, and network traffic.
 Use threat intelligence feeds to verify if flagged IPs, domains, or
behaviors are truly malicious.
 If the alert is not a threat → it's a false positive.

3. Search for Missed Incidents (Detect False Negatives):

 Conduct threat hunting or forensic reviews to find suspicious activity

that wasn't flagged.
 Compare system behavior against known attack patterns or anomalies.
 Use historical data or logs to uncover undetected threats.
 If a threat is found but no alert was generated → it's a false negative.

4. Analyze the Cause:

 For false positives: Identify overly sensitive rules or signatures causing

incorrect alerts.
 For false negatives: Find gaps in rules, misconfigured detection
systems, or outdated signatures.

5. Tune Detection Systems:

 Adjust rules, thresholds, and signatures in SIEM, IDS/IPS, or EDR

tools.
 Use machine learning models or behavior-based analysis to improve
accuracy.
 Add exclusions or whitelists for known safe behavior to reduce false
positives.

6. Re-Test and Validate:

 Test adjusted detection settings using simulated attacks (e.g., red team
exercises).
 Ensure alerts now correctly trigger for true threats and ignore safe
behavior.

7. Continuous Monitoring and Improvement:

 Continuously monitor alerts and refine detection logic.

 Use feedback from past incidents to improve accuracy.
  Regularly update tools and rules based on emerging threats.

Alert Generation:

SIEM tools generate many alerts, so incident prioritization is essential to focus

on the most critical threats first. It helps security teams respond efficiently and
reduces alert fatigue.

1. Assign Severity Scores: Rank alerts by severity (low, medium, high,

critical).
2. Evaluate Asset Importance: Prioritize incidents involving high-value
assets (e.g., servers, databases).
3. Integrate Threat Intelligence: Flag known malicious activities (IP, domain,
hash) to boost priority.
4. Analyze User Behavior: Give higher priority to alerts involving unusual
actions by privileged users.
5. Correlate Alerts: Group related alerts into incidents to show patterns (e.g.,
brute force -> escalation).
6. Consider Time Sensitivity: Prioritize ongoing attacks over past incidents.
7. Use Automation: Employ playbooks to assign priority and initiate
responses.

Threat Intelligence: It refers to the collection, analysis, and sharing of

information about potential or existing cyber threats that can help
organizations understand and defend against security risks. It involves
gathering data on attackers, tactics, techniques, and procedures (TTPs) to
proactively protect systems.

Threat intelligence feeds: Third-party threat intelligence feeds provide

external, real-time data on emerging threats, vulnerabilities, and attack
patterns. These feeds aggregate information from multiple sources such as
government agencies, security vendors, research organizations, and open-
source platforms. They deliver indicators of compromise (IOCs) like IP
addresses, domain names, file hashes, and malware signatures. Integrating
these feeds into SIEM systems or security tools enhances threat detection by
identifying known malicious entities or tactics. By using third-party feeds,
organizations can proactively defend against cyberattacks, stay updated on
global threats, and improve incident response with timely, actionable
intelligence. Popular providers include AlienVault OTX, Anomali, and
Threat Connect.

Threat hunting: It is the proactive process of searching for signs of hidden or

undetected threats within a network or system. It involves manually or using
automated tools to identify vulnerabilities, suspicious activities, and indicators
of compromise (IOCs). Unlike reactive detection, threat hunting seeks to
uncover potential risks before they escalate.

Least Privilege: The Principle of Least Privilege (PoLP) states that users,
systems, and processes should be granted only the minimum level of access
necessary to perform their tasks. This limits potential damage in case of a
 breach and minimizes the attack surface. By restricting access,
organizations reduce the risk of unauthorized actions, data leaks, and
malware propagation. Applying PoLP to users, applications, and services
ensures better security and control over sensitive resources. Regular access
reviews and role-based permissions help maintain this principle effectively.

Analyzing malware traffic: There are some ethical responsibilities and

considerations:

1. Containment and Safety: Analyze malware in secure, isolated

environments (e.g., sandboxes or air-gapped systems) to prevent accidental
spread or infection.
2. Data Privacy: Malware traffic may include personal or sensitive data—
handle it confidentially and in compliance with privacy laws like GDPR or
HIPAA.
3. Legal Authorization: Only analyze malware traffic on systems and
networks where you have explicit permission to avoid legal violations.
4. Responsible Disclosure: Report malware behavior and findings to affected
organizations and authorities ethically and responsibly to avoid misuse.
5. Do No Harm: Avoid actions that could aid attackers, such as sharing
detailed exploit code or unintentionally leaking captured data.
6. Use for Research or Defense Only: Ensure malware analysis is conducted
for educational, research, or defensive purposes, not offensive or malicious
intent.
7. Anonymize Shared Data: When sharing malware traffic samples, remove or
anonymize any data that could identify individuals or sensitive systems.

AI and ML models in UEBA:

ML and AI are the backbone of modern UEBA systems, helping detect anomalous
behaviors that may indicate insider threats, compromised accounts, or advanced
persistent threats (APTs).

Key Roles of ML and AI in UEBA:

1. Baseline Behavior Modeling: ML models learn “normal” behavior patterns

for users and entities (devices, applications) over [Link]: Normal login
times, data access habits, or file movement.
2. Anomaly Detection: AI detects deviations from established behavior
baselines. Flags activities like unusual login locations, data transfers, or access
times.
3. Risk Scoring: Each user/entity is assigned a dynamic risk score based on
their behavior. High-risk scores trigger alerts or automated responses.
4. Pattern Recognition: AI can spot subtle attack chains or lateral movements
by correlating small behavior changes.
5. Noise Reduction: ML helps reduce false positives by distinguishing
between harmless outliers and genuine threats.
6. Threat Prediction: Predicts potential future threats based on learned trends,
improving proactive defense.
 7. Continuous Learning: Models evolve with new data, adapting to changes
in user roles, devices, or workflows.

Examples of Tools Using ML/AI in UEBA:

 Microsoft Defender for Endpoint

 Splunk UEBA
 Exabeam
 IBM QRadar UEBA
 Varonis

Advanced Persistent Threats (APTs): They are stealthy, sophisticated cyberattacks

carried out by highly skilled threat actors, often for espionage, data theft, or sabotage.
APTs use multiple techniques—phishing, zero-day exploits, malware, and lateral
movement—to infiltrate networks and maintain long-term, undetected access. They
typically target high-value organizations like governments, defense contractors, and
large enterprises. APTs are "persistent" because attackers continuously monitor and
extract data over time, and "advanced" due to their use of custom tools and strategies.
Detecting APTs requires advanced security measures such as behavioral analytics,
threat intelligence, and continuous monitoring. Notable examples include APT29,
APT28, and Stuxnet.

Targeted attacks: They are deliberate cyberattacks aimed at specific individuals,

organizations, or systems, often with a clear objective like data theft, espionage, or
financial gain. Attackers conduct detailed reconnaissance to exploit known
vulnerabilities and typically use methods like spear phishing or custom malware.
These attacks are stealthy and tailored.

Random attacks: They are broad and indiscriminate, targeting a wide audience
without specific focus. Examples include mass phishing emails, generic ransomware,
or widespread malware infections. The goal is usually to exploit as many victims as
possible with minimal effort. Random attacks rely more on volume, while targeted
attacks rely on precision.

Notify External Agencies:

Notifying external agencies is a critical step in incident response, especially during

major cyber incidents involving data breaches, regulatory impact, or national security
threats. Organizations may need to inform government bodies, cybersecurity
authorities (like CERT or CSIRT), law enforcement, and regulatory agencies
depending on the nature and scope of the incident. Timely notification helps
coordinate broader defense efforts, prevents escalation, and ensures legal compliance.
Some industries are legally required to report within specific timeframes under
regulations like GDPR, HIPAA, or PCI DSS. Accurate and prompt reporting builds
trust, aids investigation, and contributes to the global cyber threat intelligence
community.
User Roles and Access Control in Splunk:

In Splunk, user roles and access control are managed to ensure that individuals only
access data and features relevant to their job roles. Splunk uses Role-Based Access
Control (RBAC) to assign permissions based on user roles such as admin, power,
user, or custom roles. Each role defines capabilities like viewing logs, editing
dashboards, or running reports. Roles also control search restrictions, limiting which
indexes or sources a user can query. Admins can create custom roles to fine-tune
access, supporting the principle of least privilege. This helps maintain security,
accountability, and data protection within Splunk environments.