Threat Intelligence for SOC

Prompts and answers

• How many unique IP addresses were provided in the IOC list?
  11
• Based on the set of IOCs, how many IOC hits were discovered in the logs?
  48
• Out of the total number of IOCs, how many unique IP addresses were discovered in the logs?
  7
• How many connections were made to 185[.]224[.]128[.]215?
  21
• What is the IP address of the compromised host?
  10.10.196.49
• What is the destination port of connections made to 107[.]175[.]202[.]151?
  80
• How many DNS queries to agrosaoxe[.]info have been created?
  11
• Before deploying the sinkhole configuration, what IPv4 addresses are resolved by agrosaoxe[.]info? (format: IPs in ascending order)
  104.21.48.143,172.67.186.179
• What is the IP address used for DNS Sinkhole?
  192.168.5.13
• How many hits were caused by connections to sinkholed domains?
  115
• How many unique domains have been sinkholed?
  12
• What is the value of the alert field in the converted ElastAlert rule?
  debug
• How many alerts were generated by the rule?
  40
• How many unique domains were sinkholed via 0.0.0.0?
  7
• What is the sinkholed domain that has .ru TLD?
  twizt.ru