Chapter 1
Security Architecture
Course: Comptia Securityx Cas 005
Subject: Comptia Securityx Cas 005 Practice Exam
Chapter: Security Operations
Understanding Indicators of Compromise (IoC)
Indicators of Compromise (IoCs) are observable artifacts on a network or system that suggest a potential security breach or malicious activity. They are used to identify, investigate, and respond to cyber threats. Effective IoC analysis enables organizations to detect attacks early and mitigate damage.
1. Types of Indicators of Compromise
Packet Capture (PCAP)
- Definition: PCAP files record network traffic, capturing raw packet data transmitted between devices.
- Use Case: Helps security teams analyze suspicious traffic patterns, such as unexpected data exfiltration.
- Example: A PCAP file showing large amounts of outbound data from a database server may indicate a data breach.
- Tool: Wireshark is commonly used to analyze PCAP files for malicious activity.
Logs
Logs provide a chronological record of system, application, and network events. Different types of logs are critical for IoC analysis: