300-215 Question 101
Select 3You are a security analyst tasked with analyzing logs from Cisco Secure Endpoint and Cisco Umbrella to identify indicators of compromise (IoCs) associated with a phishing campaign. You decide to write a Python script to parse and search the logs for specific IoCs such as suspicious domains and file hashes. Which of the following steps should be included in your script to complete this task effectively?
- A
Use Python's 'requests' library to retrieve logs via the APIs of Cisco Secure Endpoint and Cisco Umbrella.
- B
Filter the logs using regular expressions to match known IoCs such as suspicious domains and file hashes.
- C
Write a function to establish a secure connection to the PX Grid platform for real-time threat intelligence data.
- D
Store the results of the parsed logs in a structured format such as JSON or CSV for further analysis.
- E
Use Bash to query the Cisco Secure Network Analytics database directly for additional threat context.
Show answer and explanation
Correct answers: A, B, D
Explanation
To effectively parse and search logs from Cisco Secure Endpoint and Cisco Umbrella, your script should retrieve the logs via their APIs, filter the logs for known IoCs using tools like regular expressions, and store the results in structured formats for further analysis. Steps or tools unrelated to the specified data sources, such as PX Grid or Bash, are unnecessary for this task.
- A. Correct.
This is correct because using Python’s 'requests' library is a common method to interact with APIs like those provided by Cisco Secure Endpoint and Cisco Umbrella for retrieving log data.
- B. Correct.
This is correct because regular expressions are a powerful tool for searching and filtering log data for specific patterns, such as domains or file hashes.
- C. Incorrect.
This is incorrect because establishing a connection to the PX Grid platform is unrelated to parsing or searching logs from Cisco Secure Endpoint or Cisco Umbrella.
- D. Correct.
This is correct because storing parsed logs in structured formats like JSON or CSV allows for easier analysis and reporting.
- E. Incorrect.
This is incorrect because Bash is not used in this scenario. The task explicitly involves using Python to parse and search logs from Cisco Secure Endpoint and Cisco Umbrella.