A SOC receives threat intelligence indicating that an APT group uses a specific user-agent string in HTTP requests. Which SIEM query approach most efficiently detects this across all web proxy logs?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want the SIEM saved search or detection rule because it indexes the user-agent field across all proxy log sources, making enterprise-wide detection fast and scalable. Grepping raw syslog files is slow and doesn't scale, manual review is too slow, and firewall blocking is prevention, not detection.
Full Explanation
The correct approach is to create a saved search or detection rule in the SIEM that indexes and searches the user-agent field across all proxy log sources. A SIEM aggregates logs from all sources and allows indexed field searches, making detection of a specific user-agent across the entire enterprise fast and scalable. Running a regex match on raw syslog files using grep across all log servers is wrong because grepping raw syslog files is slow, does not scale across many servers, and is not sustainable for continuous detection. Manually reviewing web proxy logs on each proxy server individually is wrong because manual review of individual servers is time-intensive and cannot operate at scale or in real time. Asking the firewall team to block the specific user-agent at the perimeter is wrong because blocking a user-agent at the firewall would require HTTP inspection capability and is a prevention control, not a detection approach for historical analysis.