Security Operations Questions

A team contains a compromised endpoint and blocks malicious traffic. Which function is being performed?

A notification is generated when activity may require analyst attention. Which term fits?

A SOC uses machine learning and automated enrichment to reduce manual triage. Which optimization method is this?

A raw security-relevant occurrence is recorded by a system. Which term fits?

A SOC wants help prioritizing noisy alerts and identifying likely true threats. Which concept is most aligned?

After an incident, a team updates detections and processes to reduce future risk. Which function is being performed?

Analysts share findings across teams so related alerts are understood faster. Which optimization method is this?

A rule fires on normal administrator behavior every morning, wasting analyst time. What problem should be tuned?

A team wants network devices and servers to send logs to a central collector using a common logging protocol. Which function applies?

A benign activity is incorrectly flagged as malicious. Which term fits?

A team maps processes to a recognized security framework to guide operations. Which optimization method is this?

Security is integrated into development and operations workflows instead of being only a final review. Which term fits?

A later investigation shows malware activity occurred but the SOC never received an alert. What problem does this show?

A SOC periodically updates rules and procedures as threats and business requirements change. Which optimization method is this?

A real threat is missed and no alert is generated. Which term fits?