A Suricata rule fires on a connection: alert http $HOME_NET any -> $EXTERNAL_NET any (msg:'ET TROJAN Possible Cobalt Strike Beacon'; content:'|00 00 00 00|'; offset:4; depth:4;). The alert shows the source host is the CFO's laptop. What is the correct next analytical step?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because a single IDS alert is a lead, not a confirmed incident; pulling PCAP and verifying the byte-level pattern against Cobalt Strike signatures, then pivoting on host history, is proper triage. A is wrong because reimaging without forensic collection destroys evidence and may be premature.
Full explanation below image
Full Explanation
B is correct because a single IDS alert is a lead, not a confirmed incident; pulling PCAP and verifying the byte-level pattern against Cobalt Strike signatures, then pivoting on host history, is proper triage. A is wrong because reimaging without forensic collection destroys evidence and may be premature. C is wrong because disabling a rule due to the user's seniority introduces blind spots and does not validate whether it is a false positive. D is wrong because notifying the suspect can tip off an insider threat or a compromised user acting unwittingly.