Utilizing Data Sources to Support Investigations

There are many different types of data sources that cybersecurity teams can utilize to gain more knowledge and a clear understanding of how much damage has been done and the extent of the incident. Let’s look at the different types of data sources that we can search to support investigations, starting with a vulnerability scan output.

Vulnerability Scan Output

The vulnerability scanner can identify various vulnerabilities, such as software flaws, missing patches, open ports, services that should not be running, and weak passwords. This will help you avoid attacks such as SQL injection, buffer overflows, denial of service, and other type of malicious attacks. A credentialed vulnerability scan is the most effective as it provides more information than any other vulnerability scan.

SIEM Dashboards

Security Information Event Management (SIEM) dashboards are very useful to the security operations centers as they provide...