Synthèse
Scenario: An employee clicked a link in a phishing email which resulted in compromising their workstation. This workstation sends a DNS query for a known malicious domain, then immediately triggers an IDS alert. Step 1: Find phishing attacks by examining email_security_alerts for violations. Step 2: Use Access logs to correlate the user’s email (To) to their IP Address. Step 3: Find internal IPs querying a specific malicious domain in gateway_dns logs.
Scenario: An employee clicked a link in a phishing email which resulted in compromising their workstation. This workstation sends a DNS query for a known malicious domain, then immediately triggers an IDS alert. Step 1: Find phishing attacks by examining email_security_alerts for violations. Step 2: Use Access logs to correlate the user’s email (To) to their IP Address. Step 3: Find internal IPs querying a specific malicious domain in gateway_dns logs.