2.7 Differentiate Between Alert Grouping and Data Stitching XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst is investigating a suspected lateral movement attack. The analyst has a firewall log showing a connection from a workstation to a server, an endpoint detection alert on the server, and a user authentication log for the same time period. The analyst wants to determine if these events are part of a single attack chain. Which technique should the analyst use?

   • AAlert grouping to reduce the number of alerts generated by the firewall and endpoint systems.
   • BData stitching to merge the firewall log and authentication log into a single log entry.
   • CAlert grouping to combine the firewall log, endpoint alert, and authentication log into one incident.
   • DData stitching to correlate the firewall log, endpoint alert, and authentication log into a single attack narrative.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a typical use case for data stitching?

   • AReducing the number of false positives in a detection rule
   • BCombining all alerts from a single firewall into one incident
   • CAutomatically blocking a malicious IP address
   • DCorrelating a user's authentication logs with their endpoint activity to identify lateral movement
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following best describes the output of data stitching?

   • AA single incident containing multiple alerts
   • BA list of all alerts from a specific time window
   • CA report of all failed login attempts
   • DA unified view of an event with linked data points
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In which scenario would data stitching be most appropriate?

   • ALinking user, endpoint, and network data to trace a single attack chain
   • BPrioritizing alerts based on severity
   • CGrouping alerts from the same source IP into one incident
   • DSuppressing duplicate alerts from a specific sensor
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An analyst is reviewing two separate activities: (1) 50 alerts from a single user account attempting to access multiple sensitive files, and (2) a series of events showing a user logging in from a new device, downloading a file, and sending it via email. The analyst wants to determine if these activities are related and handle them efficiently. Which approach should the analyst take?

   • AStitch the login, download, and email events into a single data set, then group the 50 file-access alerts into that data set.
   • BStitch the 50 file-access alerts into one incident, then group the login, download, and email events into that incident.
   • CGroup all 50 file-access alerts and the login, download, and email events into a single incident without stitching.
   • DGroup the 50 file-access alerts into one incident, and stitch the login, download, and email events into that same incident to see if they are related.
   Reveal Solution Discussion Select an answer first