CySA+ · Domain 1
Security Operations
About 34% of the exam
How the SOC is organized
- Tier 1
- triage and initial validation
- Tier 2
- deeper investigation and scoping
- Tier 3
- hunting, malware, detection engineering
- MTTD
- how long until detection
- MTTR
- how long until response
- Dwell time
- entry until the alert fires
- Alert fatigue
- noise buries the real alerts
- Escalation
- hand over with documented context
Log hygiene
- Normalize formats before you correlate
- Synchronize clocks or timelines lie
- Monitor log source health continuously
- Raise verbosity on critical hosts only
- Retention reflects regulation and dwell time
- Filter noise at collection, not review
- Parsers turn raw text into fields
Two sources cannot be correlated until their clocks agree and their identifiers resolve to the same entity
Network indicators
- Beaconing
- regular callbacks at fixed intervals
- Bandwidth consumption
- large transfers out of hours
- Irregular peer-to-peer
- workstations talking to each other
- Rogue device
- unknown host on the segment
- Scans and sweeps
- one host probing many
- Unexpected ports
- mail leaving a workstation
- Traffic spike
- sudden volume with no cause
- DNS anomalies
- long random subdomain queries
Host indicators
- Capacity consumption
- disk or processor without cause
- Unauthorized software
- installed outside the process
- Malicious process
- right name, wrong parent process
- Memory only code
- nothing written to disk
- Registry change
- run key added for persistence
- Scheduled task
- created to survive reboot
- New privileges
- account joins an admin group
- File system change
- new binaries or altered timestamps
The analysis toolkit
Packet and flow
- Wireshark for full packet analysis
- tcpdump on the command line
- Follow the stream to reconstruct sessions
- Flow records show conversations, not payload
- Capture filters cut volume up front
Endpoint and file
- EDR records the process lineage
- Hash the file, then check reputation
- Strings pulls readable text out
- Static analysis never runs the sample
- Dynamic analysis detonates in a sandbox
Enrichment
- WHOIS shows domain registration age
- Reputation feeds score addresses and domains
- Newly registered domains deserve suspicion
- Automated enrichment saves analyst hours
A hash answers whether two files are identical; only behavior tells you what the file actually does
Threat intelligence and hunting
Sources
- Open source, proprietary and sharing centers
- Dark web and criminal forums
- Traffic light protocol governs sharing
- Confidence travels with the indicator
- Deduplicate and age out indicators
Models
- ATT&CK maps tactics and techniques
- Kill chain orders the intrusion stages
- Diamond model links adversary and victim
- Pyramid of pain: hashes cheap, behavior costly
Hunting
- Start with a written hypothesis
- Hunt behavior, not only indicators
- Query telemetry, then confirm or discard
- Turn every finding into a detection
Hunting is proactive and hypothesis led; if an alert started it, that is investigation, not hunting
Application indicators
- New accounts
- created outside the joiner process
- Unexpected output
- errors revealing internal detail
- Outbound connection
- a server calling out unexpectedly
- Service interruption
- crash loops or repeated restarts
- Log gaps
- records missing for a period
- Web shell
- new script in the web root
- Obfuscated link
- shortened or encoded destination
- Impossible travel
- two countries, minutes apart
Email analysis
- SPF
- which servers may send
- DKIM
- cryptographic signature on the message
- DMARC
- alignment policy plus reporting
- Return path
- where bounces actually go
- Display name abuse
- real name, attacker address
- Reply-to mismatch
- the reply lands elsewhere
- Received headers
- read the hops bottom upward
Read headers from the bottom up: the earliest Received line sits closest to the true sender
Identity signals
- MFA
- blunts stolen password attacks
- SSO
- one login, many services
- Federation
- trust between identity domains
- PAM
- vault, rotate, record privileged use
- Passwordless
- device keys instead of secrets
- CASB
- policy between users and SaaS
- Impossible travel
- classic account compromise signal
- Service account
- no human, broad rights
Architecture the analyst needs
- Segmentation shrinks what you must scope
- Zero trust re-evaluates every request
- SASE moves controls into the cloud
- Software defined networking centralizes control
- Containers are ephemeral, so collect fast
- Serverless leaves provider logs only
- TLS inspection restores payload visibility
- DLP watches data leaving the estate
Automation and orchestration
- Automate enrichment before human triage
- Playbooks standardize repeatable responses
- Keep irreversible actions behind approval
- Make automated actions safe to retry
- Integrate tools through APIs and webhooks
- Measure time saved per playbook
- The platform itself becomes a dependency
Detection engineering
- Hypothesis
- Data check
- Write the rule
- Test
- Tune
- Deploy and review
- Detect behavior rather than one payload
- Sigma rules travel between platforms
- Version control the detection content
- Baseline first, then alert on deviation
- Tune the threshold, do not disable
- Map coverage to known techniques
Using AI in the SOC
- Treat model output as unverified
- Log content can carry prompt injection
- Redact identifiers before sending prompts
- Never paste regulated data externally
- Hashing beats a model for comparison
- Record model version and promotion dates
- Sample AI-assisted tickets for accuracy
Rapid recall
- IoC
- an observable sign of compromise
- TTP
- tactics, techniques and procedures
- C2
- the attacker command channel
- LOLBin
- trusted binary abused by attackers
- UEBA
- behavior compared with baseline
- NDR
- network detection and response
- TLP
- how far intelligence may travel
- Sigma
- vendor neutral detection rule format
Reference strip: sources, indicators, tools, models
Log sources
- Firewall, proxy, DNS, DHCP
- Operating system and security logs
- Application, database, web server
- Identity provider and authentication logs
- EDR telemetry and cloud audit trails
Indicators
- Beaconing, scanning, unexpected ports
- Impossible travel and new accounts
- Registry keys and scheduled tasks
- Memory only execution and web shells
Tools
- Wireshark, tcpdump, flow records
- Volatility for memory analysis
- Strings, hashing, sandbox detonation
- WHOIS and reputation services
Models
- MITRE ATT&CK tactics and techniques
- Cyber kill chain stages
- Diamond model of intrusion analysis
- Pyramid of pain
Improvement
- Standardize then automate
- SOAR playbooks and integrations
- Detection as code with testing
- Metrics: MTTD, MTTR, coverage
Quick exam traps
- Trap: An indicator match is automatically a true positive
- Trap: Signature detection is enough for living off the land
- Trap: Encrypted traffic cannot be analyzed at all
- Trap: Threat hunting begins when an alert fires
- Trap: Blocking every feed indicator improves detection
- Trap: The hash of a file tells you what it does
- Trap: A summarizing assistant cannot invent detail
- Trap: Container evidence will still be there tomorrow
cybercertprep.com · original revision sheet written from the public body of knowledge