Part 4: Investigating Other Threats and Leveraging External Sources to Investigate Cyber Threats

This part of the book provides SOC analysts with a comprehensive guide to investigating various cyber threats utilizing threat intelligence platforms and malware sandboxing. Chapter 12 focuses on external threats and the different types of web attacks that organizations may face, as well as suspicious external access to remote services. You will gain valuable insights into the role of web application firewalls (WAFs) and application logs in detecting and investigating such attacks. In Chapter 13, the focus shifts to network flows and security solutions alerts, providing guidance on investigating cyber threats using network flows, IPS/IDS alerts, network antivirus, and sandbox alerts. The chapter also covers techniques to investigate alerts generated by Endpoint Detection and Response (EDR) and Antivirus (AV) solutions. Chapter 14 emphasizes the importance of threat intelligence in investigating...