A Suricata rule fires on a connection: alert http $HOME_NET any -> $EXTERNAL_NET any (msg:'ET TROJAN Possible Cobalt Strike Beacon'; content:'|00 00 00 00|'; offset:4; depth:4;). The alert shows the source host is the CFO's laptop. What is the correct next analytical step?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because a single IDS alert is a lead, not a confirmed incident; pulling PCAP and verifying the byte-level pattern against Cobalt Strike signatures, then pivoting on host history, is proper triage. A is wrong because reimaging without forensic collection destroys evidence and may be premature.
Full Explanation
B is correct because a single IDS alert is a lead, not a confirmed incident; pulling PCAP and verifying the byte-level pattern against Cobalt Strike signatures, then pivoting on host history, is proper triage. A is wrong because reimaging without forensic collection destroys evidence and may be premature. C is wrong because disabling a rule due to the user's seniority introduces blind spots and does not validate whether it is a false positive. D is wrong because notifying the suspect can tip off an insider threat or a compromised user acting unwittingly.