350-201 Question 157
Select 3A cybersecurity analyst is troubleshooting an issue where a Cisco Secure Endpoint detection rule is not triggering for a known malware sample. The analyst has verified that the endpoint is properly connected to the Cisco Secure Endpoint cloud and that other rules are functioning correctly. What should the analyst check next to identify the root cause of the issue?
- A
Verify the priority level of the detection rule to ensure it is not overridden by a higher-priority rule.
- B
Check if the detection rule is associated with the correct policy applied to the endpoint.
- C
Ensure the malware sample’s hash matches the hash defined in the detection rule.
- D
Investigate endpoint connectivity to the Cisco Talos Intelligence database.
- E
Review the rule's event logs to determine if the rule is being triggered but not reported.
Show answer and explanation
Correct answers: B, C, E
Explanation
When troubleshooting detection rules, it is crucial to ensure that the rule is properly associated with the endpoint's policy, correctly configured to match the intended malware sample, and functioning as expected. Reviewing logs can provide additional insights into issues such as reporting errors, while unrelated factors like priority levels or external threat intelligence connectivity are less likely to be the cause.
- A. Incorrect.
The priority level of a detection rule does not directly affect whether it triggers or not. Priority levels are typically used for response and reporting purposes, not for determining rule execution.
- B. Correct.
If the detection rule is not associated with the correct policy applied to the endpoint, the rule will not apply. This is an essential step to verify.
- C. Correct.
If the malware sample's hash does not match the hash defined in the detection rule, the rule will not trigger. This is a common misconfiguration to check.
- D. Incorrect.
Endpoint connectivity to the Cisco Talos Intelligence database is not directly related to custom detection rules. This would only matter for threat intelligence updates, not rule execution.
- E. Correct.
The event logs can provide insights into whether the rule is being triggered but not reported, helping to diagnose issues such as reporting misconfigurations.