A security analyst is reviewing historical logs for specific activities outlined in a security advisory. What is the analyst doing?

A security analyst is reviewing historical logs for specific activities outlined in a security advisory. What is the analyst doing?

• A. A packet capture
• B. User behavior analysis
• C. Threat hunting
• D. Credentialed vulnerability scanning

Answer: (C)

The activity described involves reviewing historical logs to identify specific activities that are related to a particular security advisory, which indicates an active investigation into potential security threats or indicators of compromise. This process corresponds with threat hunting. Threat hunting involves proactively searching through networks and sets of data to identify and mitigate threats that may evade existing security measures. By analyzing historical logs, the security analyst can uncover patterns, anomalies, or malicious behavior that corresponds to the advisories, thereby enhancing the organization's security posture. In contrast, packet capture refers to the process of collecting network packets to analyze traffic, while user behavior analysis focuses on understanding and analyzing user activities for unusual behaviors. Credentialed vulnerability scanning involves checking systems for vulnerabilities but does not include the proactive searching associated with threat hunting. Thus, threat hunting is the most appropriate term for the activity of reviewing historical logs in this context.

The activity described involves reviewing historical logs to identify specific activities that are related to a particular security advisory, which indicates an active investigation into potential security threats or indicators of compromise. This process corresponds with threat hunting.

Threat hunting involves proactively searching through networks and sets of data to identify and mitigate threats that may evade existing security measures. By analyzing historical logs, the security analyst can uncover patterns, anomalies, or malicious behavior that corresponds to the advisories, thereby enhancing the organization's security posture.

In contrast, packet capture refers to the process of collecting network packets to analyze traffic, while user behavior analysis focuses on understanding and analyzing user activities for unusual behaviors. Credentialed vulnerability scanning involves checking systems for vulnerabilities but does not include the proactive searching associated with threat hunting. Thus, threat hunting is the most appropriate term for the activity of reviewing historical logs in this context.