Chapter 10Incident Detection and Analysis
Responding to security incidents and network events is a common task for cybersecurity analysts, and to do so, you need to know how to detect and analyze indicators of compromise (IoCs), to acquire evidence, and to preserve it. Network-based IoCs such as excessive or suspicious bandwidth consumption, probes and scans, and rogue devices are all likely to be encountered by security professionals, and knowing how to identify and understand them is critical for security practitioners. ...
Get CompTIA CySA+ Study Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
