A SOC receives threat intelligence indicating that an APT group use…

Question

A SOC receives threat intelligence indicating that an APT group uses a specific user-agent string in HTTP requests. Which SIEM query approach most efficiently detects this across all web proxy logs?

Accepted Answer

Create a saved search or detection rule in the SIEM that indexes and searches the user-agent field across all proxy log sources — Here's the deal — b is correct because a SIEM aggregates logs from all sources and allows indexed field searches, making detection of a specific user-agent across the entire enterprise fast and scalable. A is wrong because grepping raw syslog files is slow, does not scale across many servers, and is not sustainable for continuous detection.

Answer

Run a regex match on raw syslog files using grep across all log servers

Answer

Manually review web proxy logs on each proxy server individually

Answer

Ask the firewall team to block the specific user-agent at the perimeter

A SOC receives threat intelligence indicating that an APT group uses a specific user-agent string in HTTP requests. Which SIEM query approach most efficiently detects this across all web proxy logs?

Short Explanation and Infographic

Full Explanation