The analyst has created a correlation rule to correlate events from Anti-Virus (AV), Network Intrusion Prevention (NIPS) and the firewall. While reviewing just firewall events, the analyst notices a large spike in outbound Command and Control traffic; however, the correlation rule is not triggering. The analyst then looks at the Network IPS and the Anti-Virus views and notices there are no alerts for this traffic. Which of the following features of NIPS and AV are most likely turned off?

Question

Quizplus · Accepted Answer

Heuristics are used by NIPS and AV systems to detect unknown or new threats by analyzing behavior patterns. If heuristics are turned off, these systems may not detect the Command and Control traffic, leading to no alerts being generated.

The Analyst Has Created a Correlation Rule to Correlate Events