Study. uk . com
  1. Home
  2. All questions
  3. Question 415

CISSP study material · question 415 of 500

An analyst proposes that every event in the log stream be triaged as a potential incident. How does NIST SP 800-61 Rev. 3 define an event?

  1. Any occurrence that violates a security policy.
  2. Any observable occurrence involving computing assets, such as a login attempt or a software update installing.
  3. Any occurrence that has a negative consequence for the organisation.
  4. Any occurrence that a detection rule has flagged for review.
Show the answer

Answer: B. Any observable occurrence involving computing assets, such as a login attempt or a software update installing.

SP 800-61r3 defines an event as any observable occurrence involving computing assets, giving user login attempts, installation of software updates and an application answering a request as examples.

Source: NIST SP 800-61 Rev. 3 (NIST) — SP 800-61r3 > 1. Introduction

Challenge yourself on this topic → Study as cards