【TryHackMe】SOC Fundamentals：Walkthrough

# 概要

TryHackMe「SOC Fundamentals」のWalkthroughです。

https://tryhackme.com/r/room/socfundamentals

# Task1

## **Q1**.*What does the term SOC stand for?*

**A**.**Security Operations Center**

# Task2

## **Q1**.*The SOC team discovers an unauthorized user is trying to log in to an account. Which capability of SOC is this?*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/a08763b9-97ab-cf29-82b6-e03d39fa6c77.png)

**A**.**Detection**

## **Q2**.*What are the three pillars of a SOC?*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/efce0992-4cf8-641c-0b99-5564818952a6.png)

**A**.**People, Process, Technology**

# Task3

## **Q1**.*Alert triage and reporting is the responsibility of?*

**Hint**.*Choose the relevant role from the list in the task.*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/c0fba80e-4b2e-a6b8-a646-f2f9a409ca69.png)

**A**.**SOC Analyst (Level 1)**

## **Q2**.*Which role in the SOC team allows you to work dedicatedly on establishing rules for alerting security solutions?*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/e0ebd4da-c09c-228c-b2d6-f461a0aac16d.png)

**A**.**Detection Engineer**

# Task4

## **Q1**.*At the end of the investigation, the SOC team found that John had attempted to steal the system's data. Which 'W' from the 5 Ws does this answer?*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/60f96893-9b5d-c711-cfa9-ded358d13ecd.png)

**A**.**Who**

## **Q2**.*The SOC team detected a large amount of data exfiltration. Which 'W' from the 5 Ws does this answer?*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/6710d4f7-52e3-5b03-e794-4d20a3ae029a.png)

**A**.**What**

# Task5

## **Q1**.*Which security solution monitors the incoming and outgoing traffic of the network?*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/ee9db2bc-d595-065e-9b6d-681d5b3235cc.png)

**A**.**Firewall**

## **Q2**.*Do SIEM solutions primarily focus on detecting and alerting about security incidents? (yea/nay)*

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/d862d959-3d14-90d1-f787-274ee18d664a.png)

**A**.**yea**

# Task6

## **Q1**.*What: Activity that triggered the alert?*

ポートスキャンのアクティビティが検知されました。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/8d4c831a-abb0-a3fc-f94e-828078fe00ab.png)

**A**.**Port Scan**

## **Q2**.*When: Time of the activity?*

**A**.**June 12, 2024 17:24**

## **Q3**.*Where: Destination host IP?*

`SIEM Solution`の画面から`Destination host ip`が確認できます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/31b8af3c-582d-a767-25e2-2f14492c7499.png)

**A**.**10.0.0.3**

## **Q4**.*Who: Source host name?*

`Source Host Name`を確認できます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/54ee78ee-b565-b213-5c61-d453d5b0993e.png)

**A**.**Nessus**

## **Q5**.*Why: Reason for the activity? Intended/Malicious*

**A**.**Intended**

## **Q6**.*Additional Investigation Notes: Has any response been sent back to the port scanner IP? (yea/nay)*

**A**.**yea**

## **Q7**.*What is the flag found after closing the alert?*

プライベートIPレンジからのポートスキャンなので誤検知になります。
解答に正解するとフラグが表示されます。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/f8302744-1e9a-a705-502e-8dfd2e965c28.png)

**A**.**THM{000_INTRO_TO_SOC}**