SecurityX (CASP+) · Domain 4
Security Operations
About 22% of the exam
Detection engineering
- Write detections against attacker behavior
- Sigma keeps rules portable between platforms
- Version control and peer review
- Test with emulated techniques
- Measure coverage against known techniques
- Retire rules that never fire
- Document the intent of each rule
Aggregation and correlation
- Collection
- agents, forwarders and cloud APIs
- Normalization
- one schema across many sources
- Enrichment
- add asset, identity and intelligence
- Correlation
- combine events into one alert
- Time synchronization
- without it the timeline lies
- Entity resolution
- the same user across sources
- Retention tiers
- hot search, warm, cold archive
- Source health
- a silent source is a blind spot
Behavioral baselines
- Baseline per host and per identity
- Account for daily and weekly cycles
- Service accounts should look mechanical
- Flag behavior seen for the first time
- Rare parent and child process pairs
- Volume anomalies against the peer group
Triage and tuning
- Severity
- impact combined with confidence
- Enrichment first
- context before a human looks
- True positive rate
- how much of the queue matters
- Suppression
- known good, documented and reviewed
- Threshold tuning
- raise the bar, keep the signal
- Escalation
- handover with the evidence attached
- Feedback loop
- outcomes improve the rule
Threat hunting and intelligence
Intelligence
- Strategic, operational and tactical layers
- Traffic light protocol governs sharing
- Confidence and source reliability recorded
- Age indicators out deliberately
- Profile the actors targeting your sector
Hypothesis
- Start from a technique, not an alert
- State the data you need
- Define what would disprove it
- Time box every hunt
Outcomes
- Each hunt yields a detection or gap
- Record the negative result too
- Feed findings into the risk register
- Improve telemetry where you were blind
Artifacts in incident response
Acquisition
- Volatility order, memory before disk
- Write blocker and verified hashes
- Snapshot cloud volumes before terminating
- Collect provider audit logs early
Host and memory
- Process trees and injected code
- Persistence in tasks, services, registry
- Execution artifacts and event logs
- Timeline from file system metadata
Network and cloud
- Flow records outlive packet captures
- Proxy and DNS logs place the beacon
- Identity logs show token misuse
- Control plane logs reveal privilege changes
In cloud incidents the control plane log is often the only witness, because the workload itself was destroyed minutes later
Prioritizing vulnerabilities
- Exploited in the wild
- the strongest single signal
- Exploit maturity
- weaponized code is available
- Exposure
- internet facing or internal only
- Asset criticality
- what the system supports
- Compensating control
- already reduced in practice
- Chaining
- two mediums make a critical
- Patch risk
- the fix may break production
Testing the defenses
- Vulnerability scan
- broad, automated, known issues
- Penetration test
- manual, proves real exploitation
- Red team
- objective led, tests detection
- Purple team
- attack and defense working together
- Breach simulation
- continuous validation of controls
- Bug bounty
- external researchers, scoped and paid
- Tabletop
- decision making under pressure
Automating response
- Automate enrichment and ticket creation
- Human approval before destructive actions
- Playbooks versioned like code
- Make every action safe to repeat
- Fail safe when an integration breaks
- Measure time saved and error rate
Techniques worth detecting
- Beaconing
- steady callbacks with jitter
- Living off the land
- signed system binaries misused
- Credential dumping
- reading the secret store from memory
- Token theft
- session replayed without a password
- Lateral movement
- remote services and scheduled tasks
- Defense evasion
- logs cleared, agents disabled
- Exfiltration
- staged, compressed, then sent out
- Domain generation
- algorithmic domains defeat blocklists
Metrics that survive the board
- MTTD
- detection latency after entry
- MTTR
- containment or full recovery
- Dwell time
- the number executives remember
- Coverage
- techniques with a working detection
- False positive rate
- the tax on analysts
- Automation rate
- alerts closed without a human
- Escalation accuracy
- correct at the first handover
Turning incidents into improvement
- Timeline
- Root cause
- Contributing factors
- Actions
- Owners
- Retest
- Retest the control that failed
- Update playbooks and detections together
- Share lessons beyond the security team
- Track recurrence as a metric
Know the order
- Response
- prepare, detect, contain, eradicate, recover
- Evidence
- memory, network state, disk, backups
- Hunt
- hypothesis, data, analysis, detection
- Triage
- enrich, validate, scope, escalate
- Vulnerability
- discover, validate, prioritize, fix, verify
Key numbers
- CVSS critical
- 9.0 and above
- Breach notice
- 72 hours under GDPR
- Kill chain
- seven ordered stages
- Volatility
- memory first, backups last
- Retention
- hot, warm and cold tiers
Reference strip: collect, detect, hunt, respond
Collect
- Endpoint, network, identity, cloud
- Normalization and enrichment pipelines
- Time synchronization and entity resolution
- Retention tiers and source health
Detect
- Behavioral rules over static indicators
- Sigma content under version control
- Baselines, anomalies, peer comparison
- Coverage mapped to techniques
Hunt
- Hypothesis driven and time boxed
- Intelligence with confidence levels
- Actor profiles for your sector
- Gaps recorded as telemetry work
Respond
- Enrichment, approval, containment
- Memory, disk, cloud control plane
- Chain of custody and timeline
- Root cause and retested controls
Validate
- Scanning, penetration testing, red team
- Purple team and breach simulation
- Bug bounty and disclosure handling
- Tabletop and functional exercises
Quick exam traps
- Trap: More alerts mean better detection coverage
- Trap: An indicator feed is the same as threat intelligence
- Trap: Hunting begins with an alert that fired
- Trap: A red team engagement tests the same thing as a scan
- Trap: Automation should also make containment decisions
- Trap: Packet capture is always available for old incidents
- Trap: Clearing the malware ends the investigation
- Trap: Cloud workloads can be analyzed after termination
cybercertprep.com · original revision sheet written from the public body of knowledge