SecOps Fundamentals Flashcards
(21 cards)
What Is Cortex?
Cortex is an artificial-intelligence-based, continuous security platform. Cortex allows organizations to create, deliver, and consume innovative new security products from any provider without additional complexity or infrastructure.
The goal of any security team
is to defend an organization’s infrastructure and data from damage, unauthorized access, and misuse.
Cortex XSOAR
allows security teams to ingest alerts across multiple sources and then execute automatable playbooks for accelerated incident response.
Cortex XSIAM
is an artificial intelligence (AI)-powered security operations platform that revolutionizes the way data, analytics, and automation get deployed to outpace modern threats.
Behavioral Threat Protection LIfecycle
- Endpoint Attacks Generate Multiple Events
- Cortex XDR Executes Policy-Based Action
- Cortex XDR prevents Script-based, file-less attacks
- Cortex XDR Blocks Ransomeware
How does the Cortex XDR agent block zero day attacks/
By blocking the exploitation techniques that attackers use to manipulate applications.
Actions available when remediation on the endpoint is needed following an alert or investigation.
Isolate Endpoint
Terminate Process
Block Additional Executions
Quarantine Malicoius Files
Retrieve Files
Access Endpoints with Live Terminal
Orchestrate Reponse
3 Areas of Focus with XSOAR
Workflow Automation
Ticketing
Collaboration
Goals of Cortex XSOAR
Accelerated Responses
Collaboration and Learning
Standardized Process
Reduced Risk
TIM
Threat Intelligence Management
XSIAM
Extended Security Intelligence and Automation Management
Part EDR, SOAR, as well as Attack Surface Management (ASM)
What technology is set to replace SIEM?
XSIAM
Extended Security Intelligence and Automation Managment
What four technologies make up Cortex XSIAM?
SOAR
EDR
ASM
SIEM
SOAR
SOAR is a technology designed to centralize and automate routine tasks as well as enrich the work of security analysts by performing mundane tasks as soon as the alert is handled.
ASM
technology is designed to utilize the attacker’s perspective in the discovery, management, identification, and monitoring of an organization’s internet-facing perimeter.
SIEM
is a technology that has been integrated into security operations for nearly two decades. SIEMs ingest and store logs, normalize them, run rules against the normalized logs, and create alerts based upon preconfigured logic.
Which Cortex technology combines multiple methods of prevention at critical phases within the attack lifecycle to halt the execution of malicious programs and stop the exploitation of legitimate applications, regardless of operating system?
XDR
What is the purpose of using decoy files in the Cortex XDR agent’s behavior-based ransomware protection module?
To attract ransomware and analyze its behavior
Which three areas of focus can Cortex XSOAR help SecOps teams combat security challenges? (Choose three.)
Workflow Automation
Ticketing
Collaboration
Which security technology is known for storing, ingesting and normalizing logs and running rules against them?
SIEM
