An analyst is investigating a potentially compromised endpoint within the network and pulls a host report for the endpoint in question to collect metrics and documentation. What information should be taken from this report for the investigation?
A.
client applications by user, web applications, and user connections
B.
number of attacked machines, sources of the attack, and traffic patterns
C.
intrusion events, host connections, and user sessions
D.
threat detections over time and application protocols transferring malware
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit