Utilizing Data Sources to Support Investigations
There are many different types of data sources that cybersecurity teams can utilize to gain more knowledge and a clear understanding of how much damage has been done and the extent of the incident. Let's look at the different types of data sources that we can search to support investigations, starting with a vulnerability scan output.
Vulnerability Scan Output
The vulnerability scanner can identify various vulnerabilities, such as missing patches, open ports, services that should not be running, and weak passwords. This will help you avoid attacks such as SQL injection, buffer overflows, denial of service, and other type of malicious attacks.
SIEM Dashboards
Security Information Event Management (SIEM) dashboards are very useful to the security operations centers as they provide information in real time. Let's look at the types of data that could be found on a SIEM dashboard, staring with sensors:
- Sensor...
