Security Solutions: Introduction to SIEM (TryHackMe)

Search for a command to run...

No comments yet. Be the first to comment.
Link to the challenge on TryHackMe: Modern Web Stacks Introduction During a time-boxed engagement, the first tester to identify Apache/2.4.49 in a Server: header already knows the exact CVE before the

Link to the challenge/walkthrough on TryHackMe: Broken Authentication Introduction Authentication is the process by which a web application verifies the identity of the user making a request. It typic

Link to the HealthGPT AI security CTF challenge on TryHackMe. Meet HealthGPT, a well-meaning virtual assistant used by a busy healthcare team. It helps clinicians look up procedures, draft notes, and

Link to the section of the AI Odyssey CTF on TryHackMe: Token City. It covers challenges like: ML Sec: The Loan Arranger | AI Sec + DFIR: Rogue Commit | AI Sec + Web App Sec: Sealed Substation | Agent

Link to the Privilege Escalation Challenge on TryHackMe: Linux Privilege Escalation: Automation Introduction By now, you should have an understanding of basic privilege escalation techniques and how t

In this article, I will write a write-up for Introduction to SIEM that covers Network Visibility through SIEM, Log Sources and Log Ingestion, Why SIEM, Analysing Logs and Alerts, and Lab Work.
What does SIEM stand for? Security Information and Event Management system
Is Registry-related activity host-centric or network-centric? host-centric
Is VPN related activity host-centric or network-centric? network-centric
In which location within a Linux environment are HTTP logs stored? /var/log/httpd
Which Event ID is generated when event logs are removed? 104
What type of alert may require tuning? False Alarm
In the static lab attached, a sample dashboard and events are displayed. When a suspicious activity happens, an Alert is triggered, which means some events match the condition of some rule already configured. Complete the lab and answer the following questions.
Click on Start Suspicious Activity, which process caused the alert? cudominer.exe

Find the event that caused the alert, which user was responsible for the process execution? chris.fort

What is the hostname of the suspect user? HR_02
Examine the rule and the suspicious process; which term matched the rule that caused the alert? miner

What is the best option that represents the event? Choose from the following:
False-Positive
True-Positive
True-Positive
Selecting the right ACTION will display the FLAG. What is the FLAG? THM{000_SIEM_INTRO}

Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the THM challenges.