A SIEM correlation rule fires when more than 10 failed authentication attempts are followed by a successful authentication within 5 minutes from the same source IP. An alert fires for a service account. What should the analyst investigate FIRST?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to check whether the successful login is expected for that service account and source IP, then review what happened after authentication. That tells you if this is a successful brute force or just an authorized system with connectivity issues.
Full Explanation
Investigate first whether the successful authentication is expected for this service account and source IP, and whether any suspicious actions occurred after authentication. Confirming expected source, normal time, and expected target system, then reviewing post-authentication activity, distinguishes a successful brute force from an authorized system with connectivity issues. Checking password complexity is wrong because it is a preventive control, not the immediate priority for a logged event. Checking how often the rule fired this month is wrong because frequency gives context but not what happened in this alert. Checking patch status is wrong because it addresses vulnerabilities, not this authentication anomaly.