CYS406 · Annotated SlidesChapter 15 — SIEM, UBA and Anti-Malware
Chapter 15 · Annotated slides

SIEM, UBA and Anti-Malware

Security Information and Event Management (architecture, functions, products), User Behavior Analytics, and anti-Trojan and antivirus software.

Slide text Study notes Highlight: key words Tips, tricks & traps Seen again elsewhere How it can come up
Slide 1: Slide 1
Exam weight Low
    Slide 2: Module Objectives
    Exam weight Low
      Slide 3: Module Flow
      Exam weight Low
        Slide 4: Security Incident and Event Management (SIEM)
        Exam weight High
        1. SIEM: collects and correlates logs and events from many sources in real time; alerts, dashboards, compliance reports.
        🎯 How this can come up · 1 question
        MCQ

        A system that aggregates and correlates logs from many devices to raise alerts is a:

        Slide 5: SIEM Architecture
        Exam weight Low
          Slide 6: SIEM Functions
          Exam weight Low
          1. Functions: log collection, aggregation, normalization, correlation, alerting, retention, forensics, reporting.
          Slide 7: SIEM Solutions
          Exam weight Low
            Slide 8: Module Flow
            Exam weight Low
              Slide 9: User Behavior Analytics (UBA)
              Exam weight High
              1. UBA/UEBA: builds a baseline of normal user behaviour and flags anomalies (insider threats, compromised accounts).
              🎯 How this can come up · 1 question
              MCQ

              An employee suddenly downloading gigabytes at 3 a.m. would most likely be flagged by:

              Slide 10: Why User Behavior Analytics is Effective?
              Exam weight Low
                Slide 11: UBA/UEBA Tools
                Exam weight Low
                  Slide 12: Module Flow
                  Exam weight Low
                    Slide 13: Anti-Trojan Software
                    Exam weight Low
                      Slide 14: Antivirus Software
                      Exam weight Low
                      1. Antivirus: signature, heuristic and behaviour-based detection; keep definitions updated.
                      Slide 15: Module Summary
                      Exam weight Low