Cyber Attacks and Defense in Practice
Which of the following correctly matches SIEM, SOAR and SOC with their roles in security monitoring?
- ASIEM is software that records endpoint behavior, SOAR is a device that encrypts traffic, and SOC is an identifier given to vulnerabilities
- BSIEM automatically runs response procedures, SOAR collects and analyzes logs from each device, and SOC is the development team that handles product vulnerabilities
- CSIEM collects and correlates logs from many devices, SOAR automatically runs response procedures (playbooks), and SOC is the team that uses them for monitoring
Show answer and explanation
Answer: C. SIEM collects and correlates logs from many devices, SOAR automatically runs response procedures (playbooks), and SOC is the team that uses them for monitoring
SIEM (security information and event management) collects logs from firewalls, servers, EDR, cloud services and so on in one place, aligns their timestamps and presents suspected attacks as alerts using rules that combine several events (correlation analysis). SOAR (security orchestration, automation and response) automatically runs set procedures such as gathering information, isolating devices and disabling accounts as playbooks in response to alerts, reducing analysts' workload. The SOC (security operations center) is the team that uses these to monitor, analyze alerts and determine and report whether something is an incident, and it often operates around the clock. Response to the incidents identified by the SOC is usually led by the CSIRT.
- A. Recording endpoint behavior is EDR, and identifiers for vulnerabilities are CVEs.
- B. The descriptions of SIEM and SOAR are reversed. Also, the team that handles product vulnerabilities is the PSIRT.
- C. Correct. SIEM collects and analyzes, SOAR automates procedures and the SOC is the team that operates them.
Continue: 9 more Cyber Attacks and Defense in Practice questions