Security Operations · Objective 4.4

Applied

Three logs arrive in ten minutes: VPN failures for one user, then a VPN success, then a large download from a file server that user rarely touches. A single rule fires only when all three occur together. What is that rule doing?

Security alerting and monitoring

Pick an answer. You’ll see if it’s right. The longer explanation is what a plan opens.

28 items in the public index.