English
Menu

Cyber Attacks and Defense in Practice

At a SOC, the SIEM raises 1440 alerts a day, occurring evenly throughout the day. SOAR's automated processing handles 75% of the alerts without analyst review, and each remaining alert needs an average of 10 minutes of analyst work. Assuming analysts can work without breaks, which of the following is the minimum number of analysts who must be on duty at all times to keep up with the rate at which alerts occur?

  1. A2 analysts
  2. B3 analysts
  3. C10 analysts
Show answer and explanation

Answer: B. 3 analysts

The alerts that analysts review number 1440 × (1 − 0.75) = 360 a day, or 360 ÷ 24 = 15 an hour. One analyst can handle 60 ÷ 10 = 6 alerts an hour, so the number needed is 15 ÷ 6 = 2.5, which rounds up to 3. Without SOAR's automated processing there would be 60 alerts an hour, requiring 60 ÷ 6 = 10 analysts. In practice there are breaks and other duties, and the number of alerts varies by time of day, so staffing is decided with a margin in utilization.

  • A. This rounds 2.5 down; only 12 alerts an hour can be handled, and alerts pile up.
  • B. Correct. 15 ÷ 6 = 2.5, rounded up to 3.
  • C. This is the number needed if there were no SOAR automation and people reviewed every alert (60 an hour).
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?
  2. MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?
  3. Which of the following is an "initial access" method, by which an attacker first gets into an organization's network?
  4. An examination of the records of traffic on an internal network found the following traffic. Which of them most strongly suggests that malware is communicating with an external command server (C2 server)?
  5. An attacker who exploited a vulnerability in a web application can now run commands with the same ordinary user privileges as the web server program. Which of the following is an example of the "privilege escalation" the attacker carries out next?

Comparisons in this topic