-
Book Overview & Buying
-
Table Of Contents
Microsoft Security Operations Analyst Exam Ref SC-200 Guide - Second Edition
By :
In this chapter, you will see the terms feeds and alerts used frequently. We want to ensure that you have a full understanding of the differences and the use cases. What is a feed? What is an alert? You can now find out!
A feed is a constant stream of activity that has been configured for ingestion or analysis. This activity is used for statistical purposes, and sometimes, this is referred to as an audit trail or log/logging, for example, a record of each time a door opens and closes. This would be an audit of how many times and each time the door was opened or shut.
An alert is a notification generated in response to an event or a sequence of events that is characteristic of suspicious behavior. The alert is intended to bring the events to the attention of an operator or a SOC analyst. For example, whenever that same door is slammed open or slammed shut, an alert will be generated. You will then be able to review the audit log/feed to...
Change the font size
Change margin width
Change background colour