Security Solutions: Introduction to SIEM (TryHackMe)

In this article, I will write a write-up for Introduction to SIEM that covers Network Visibility through SIEM, Log Sources and Log Ingestion, Why SIEM, Analysing Logs and Alerts, and Lab Work.

1. What does SIEM stand for? Security Information and Event Management system

2. Is Registry-related activity host-centric or network-centric? host-centric

3. Is VPN related activity host-centric or network-centric? network-centric

4. In which location within a Linux environment are HTTP logs stored? /var/log/httpd

5. Which Event ID is generated when event logs are removed? 104

6. What type of alert may require tuning? False Alarm

In the static lab attached, a sample dashboard and events are displayed. When a suspicious activity happens, an Alert is triggered, which means some events match the condition of some rule already configured. Complete the lab and answer the following questions.

7. Click on Start Suspicious Activity, which process caused the alert? cudominer.exe

   

8. Find the event that caused the alert, which user was responsible for the process execution? chris.fort

   

9. What is the hostname of the suspect user? HR_02

10. Examine the rule and the suspicious process; which term matched the rule that caused the alert? miner

    

11. What is the best option that represents the event? Choose from the following:

    • False-Positive

    • True-Positive

True-Positive

12. Selecting the right ACTION will display the FLAG. What is the FLAG? THM{000_SIEM_INTRO}

    

Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the THM challenges. We can also connect more on LinkedIn or X.