CompTIA CySA+ CS0-004 — Security Operations: Tools, Threat Intel & AI

SIEM (Security Information and Event Management) aggregates log data from across the environment, normalizes it, applies correlation rules, and generates alerts when patterns match known threats or anomalies.

• SIEM components: Log collection agents, ingestion pipeline, parsing/normalization engine, correlation engine, alert manager, dashboards, and long-term storage for threat hunting.
• Correlation rules: Logic that fires an alert when multiple related events occur. Example: "5 failed logins followed by a successful login within 2 minutes" → brute force correlation rule.
• Use case development: Define what threat you're detecting → identify the log sources needed → write detection logic → set threshold to minimize false positives.
• Alert tuning: SIEM generates too many false positives initially. Tuning involves adding exclusions (whitelisted IPs, admin accounts), adjusting thresholds, and enriching alerts with context before they reach analysts.
• Data enrichment: Adding context to raw events — GeoIP, user identity (from AD), asset criticality, threat intel lookups (is this IP known malicious?) — reduces analyst investigation time.
• MTTD (Mean Time to Detect): Key SIEM metric — average time from compromise to alert generation. Lower is better. Correlation rule quality directly impacts MTTD.

• EDR (Endpoint Detection & Response): Agent-based security deployed on endpoints. Provides behavioral monitoring, memory inspection, process telemetry, file integrity monitoring, and response capabilities (isolate host, kill process, collect forensic artifacts remotely).
• XDR (Extended Detection & Response): Expands EDR across multiple security domains — endpoint, network, cloud, identity, email — correlating signals across all sources for higher-fidelity detections. Reduces alert fragmentation across point tools.
• EDR vs. traditional AV: AV = signature-based (known malware hashes). EDR = behavioral (detects novel attacks by what they do, not what they are). EDR catches LOLBins and fileless malware that AV misses.
• MDM (Mobile Device Management): Enforces security policies on mobile endpoints — remote wipe, screen lock, encryption enforcement, app whitelisting, certificate push. Important for BYOD environments.
• Key EDR detection capabilities: Process injection detection, memory scraping detection, credential dumping detection (LSASS access), persistence mechanism monitoring (registry run keys, scheduled tasks, services).

• Wireshark: GUI packet analyzer. Key skills: display filters (ip.addr == 192.168.1.1, tcp.port == 443, http.request), "Follow TCP Stream" to reconstruct sessions, Statistics menu for protocol breakdown, expert info for anomalies.
• tcpdump: Command-line packet capture. Key syntax: tcpdump -i eth0 -w capture.pcap, tcpdump host 10.0.0.1, tcpdump port 80, tcpdump -r capture.pcap to read a file.
• Snort/Suricata: Rule-based NIDS/NIPS. Rule anatomy: action, protocol, source IP/port, direction, destination IP/port, options. alert tcp any any -> $HOME_NET 22 (msg:"SSH scan"; flags:S; threshold:type both, track by_src, count 5, seconds 60; sid:1001;)
• Zeek (formerly Bro): Network security monitor — generates rich connection logs (conn.log, dns.log, http.log, ssl.log, files.log) rather than raw packet captures. Excellent for threat hunting on network traffic. Supports custom detection scripts.
• Network flow data (NetFlow/IPFIX): Summary-level traffic data (src/dst IP, ports, bytes, packets, duration) without payload. Useful for detecting beaconing, unusual volumes, port scans — less storage than full PCAP.

Threat intelligence is processed, contextualized information about adversary TTPs, infrastructure, and capabilities used to inform defensive decisions.

• TLP (Traffic Light Protocol): Controls intelligence sharing: TLP:RED (recipient only), TLP:AMBER (limited sharing within org), TLP:GREEN (community sharing), TLP:WHITE/CLEAR (unrestricted public sharing).
• Intel platforms: OTX (AlienVault Open Threat Exchange — community IOC feeds), MISP (open-source intel sharing platform — for structured intel), OpenCTI (threat intelligence knowledge management).
• ISAC/ISAO feeds: Sector-specific intel sharing (FS-ISAC for financial, H-ISAC for healthcare). Government feeds: CISA AIS (Automated Indicator Sharing), MS-ISAC.
• Atomic vs. behavioral IOCs: Atomic = specific artifacts (hash, IP, domain) — easily evaded. Behavioral = patterns of activity (what an attacker does, not what they use) — maps to ATT&CK TTPs, harder to evade.

• Structure: Tactics (the "why" — adversary goal: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command & Control, Impact). Techniques (the "how" — specific method: T1566 Phishing). Sub-techniques (T1566.001 Spearphishing Attachment).
• ATT&CK Navigator: Web-based tool for visualizing coverage, heat maps, and technique comparisons. Used for adversary emulation planning and detection gap analysis.
• Heat maps: Visualize which ATT&CK techniques your current detections cover (green) vs. gaps (red). Used for prioritizing SIEM use case development.
• Attribution: Mapping observed TTPs to known threat actor groups. ATT&CK groups database tracks APT groups' known techniques. Attribution helps predict next moves.
• Adversary emulation: Using ATT&CK to plan red team exercises — emulate specific threat groups that target your sector to validate detection coverage.

YARA is a pattern-matching tool used to identify and classify malware samples. Rules describe patterns found in malicious files.

rule Malware_Dropper_Example {
    meta:
        author = "SOC Analyst"
        description = "Detects dropper with embedded PE"
        date = "2026-06-09"
    strings:
        $mz = { 4D 5A }          // MZ header hex
        $str1 = "cmd.exe /c" nocase
        $str2 = "powershell -enc" nocase
    condition:
        $mz at 0 and any of ($str1, $str2)
}

• Rule sections: meta (informational), strings (patterns: text, hex, regex), condition (Boolean logic combining strings).
• Key conditions: all of them (every string must match), any of them (at least one), filesize < 1MB, uint16(0) == 0x5A4D (MZ header check).
• Scripting for security analysts (CS0-004 scope): Python (log parsing, API queries to threat intel platforms, regex-based IOC extraction), PowerShell (querying Windows Event Logs: Get-WinEvent, AD enumeration detection), Bash/shell (grep patterns in logs, awk for field extraction, sed for normalization).
• Sigma rules: SIEM-agnostic detection rules in YAML format. Can be converted to queries for Splunk, Elastic, QRadar, etc. Useful for sharing detections across organizations regardless of SIEM vendor.

• Threat hunting: Proactive, analyst-led search for adversaries already in the environment before alerts fire. Assumes compromise has occurred or is likely and hunts for evidence.
• Hypothesis-driven hunting: Start with a threat hypothesis ("An attacker using Cobalt Strike would beacon to C2 every ~60 seconds with jitter"). Search for data matching that hypothesis. Document results regardless of outcome.
• IOC-based hunting: Start with known indicators (IP, hash, domain) from threat intel feeds and search logs/EDR telemetry for matches.
• STRIDE threat modeling: Framework for identifying threats: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. Used in design-phase threat modeling.
• Cyber deception: Honeypots (fake systems that attract attackers), honey credentials (fake accounts/passwords that trigger alerts if used), canary tokens (files/links that alert when accessed). Provides early warning of attacker activity.
• SOAR (Security Orchestration, Automation and Response): Ingests SIEM alerts → runs automated playbooks → enriches with threat intel → escalates or auto-remediates. Reduces MTTR by eliminating manual repetitive tasks.
• SOAR playbook example: Alert fires (phishing email) → SOAR extracts URLs → checks VirusTotal API → if malicious: blocks sender, quarantines email, creates ITSM ticket, notifies analyst. All automated in seconds.
• API/webhook integrations: SOAR connects tools via APIs — SIEM, ITSM (ServiceNow, Jira), threat intel platforms, EDR, email gateway. Webhooks trigger playbooks on events.

CS0-004 explicitly adds AI in security operations as new exam content. This is unique to this version and not in CS0-003.

• AI use cases in security ops:
  • Log analysis and summarization — processing large volumes faster than humans
  • Alert correlation and triage — grouping related alerts into incidents
  • Artifact comparison — comparing files, behaviors, or indicators against known patterns
  • Investigation assistance — generating investigation plans, summarizing findings
  • Documentation creation — auto-generating incident reports, runbooks
  • Automation/orchestration — driving SOAR playbook decisions
• AI risks in security operations:
  • Hallucinations: AI generates false but confident-sounding analysis. Analyst must verify AI output against source data — never trust AI analysis without validation.
  • Data exposure: Sending sensitive logs, PII, or proprietary data to external AI services violates privacy and compliance requirements. Only approved tools should receive sensitive data.
  • Model poisoning: Attacker manipulates AI training data to degrade detection capability or create blind spots. Relevant for AI-based anomaly detection systems.
  • Malicious prompts / prompt injection: Adversary crafts inputs (in log data, emails, or documents) specifically designed to manipulate an AI security tool's analysis or cause it to take unintended actions.
• AI governance controls: Acceptable use policy (what AI tools are approved, what data they may receive), mandatory human review of AI-generated security decisions, audit logging of AI actions, sensitivity classification of data before sending to AI, regular output validation, legal and regulatory compliance review.