Home
DAILY CHALLENGE
A SIEM rule fires: "Possible data exfiltration — large outbound transfer". First move?
~1 min
+25 XP
A SIEM rule fires: "Possible data exfiltration — large outbound transfer". First move?
Block the user's account immediately
Establish context: who, what host, destination, and whether this is normal for them
Close it — these rules are noisy
Escalate to legal and notify customers
Check answer