Sec Plus 33%

Chronological records of events and actions. Sources include firewalls, IDS/IPS devices, proxy servers, OS, and databases

Indicators of Attacks. Behaviors or actions that suggest an attack that is happening or is about to happen

Indicators of Compromise. Evidence that a system may have been compromised

Security Information and Event Management. Automation tool for real-time data capture event correlation analysis and reporting

Threat Intelligence Platform. Automation tool that combines multiple threat intelligence feeds and integrates with existing SIEM feeds

User and Entity Behavior Analytics. Automation tool that models the behavior of humans and machines to identify abnormal behavior

Security Orchestration, Automation, and Response. Responds to the alerts, triaging the data, and taking retaliation steps.

Simple Network Management Protocol. Allows administrators to monitor and manage network services. Provides a standardized framework, SNMP queries are GET requests

Modules installed on managed devices

Cisco device that monitors network traffic and data by analyzing flow data. Is used for traffic analysis, capacity planning, bandwith utilization, malocious sources, detect anomalies.

Industry standard protocol based on Netflow to give a vendor-agnostic format

Sequence of events that share common characteristics

Security Content Automation Tool. A collection of open standards developed by NIST to automate the process of managing and evaluating security in computers.

Common Vulnerabilities & Exposures

Common Configuration Enumeration

Common Platform Enumeration

Common Vulnerability Scoring System

Open Vulnerability and Assessment Language

Set of Instructions for planning for an attack

Process of anticipating threats

The point which an incident or issue requires a higher level of response

Review plans & procedures for completeness. Obj- accuracy

Scenario based group worship focused on the application of plans. Obj- familiarity, coordination, accuracy

Scenario that simulates actual event. Obj- readiness

If the incident has occurred, and the extent of the problem if it has

Root Cause Analysis

Supports the truth of an assertion directly

Relieds on an inference to connect it to a conclusion of fact. IE a fingerprint on a crime scene

Electronic Discovery

Order that suspends changing digital data

Manipulating digital data

Can it be used in court?

Quality and completeness of evidence

Acquisition of evidence before it disappears

Data that is easily degradable

Chain of custody- chronological documentation

General Data Protection Regulation. EU regulation that has very stringent breach disclosure and notification requirements

Value to detect errors

Fixed length blocks of disk space indexed in a table

Space between the end of file and end of cluster

Clusters that aren't allocated to a file

Process by which deleted files are recovered

Data about data

Information Sharing and Analysis Center

Structured Threat Information Expression. Standardized language developed by MITRE for describing cyber threat info

Trusted Automated eXchange of Intelligence Information. Defines shared cyber info. 3 models: Hub & Space, Source, and Peer-To-Peer