Wazoo Security Tool Concepts

The video tutorial by Toby from Oine Security covers a lab for Security Plus 701, focusing on the detection phase of the incident response process. It demonstrates using the set command to create a password list, accessing the Wazuh platform to monitor security events, conducting a password attack with Hydra, and detecting these activities. The tutorial also covers mounting a drive, authentication attempts, and clearing logs, emphasizing the importance of detecting and analyzing security events using Wazuh.

What phase of the incident response process is focused on in this lab?

• Containment

• Detection

• Eradication

• Recovery

Which command is used to add a password to the 57th line of a file?

• cat

• awk

• grep

• sed

What is the purpose of the Wazoo security tool?

• To monitor and identify malicious activity

• To encrypt data

• To create passwords

• To backup files

What is the username used to log into the Wazoo platform?

• user

• admin

• guest

• root

Which tool is used to conduct a password attack in this lab?

• Hydra

• John the Ripper

• Nmap

• Metasploit

What protocol does Hydra use to attempt to log into the machine?

• FTP

• SSH

• HTTP

• RDP

What is the significance of the rule ID 60122 in Wazoo?

• It indicates a successful login

• It indicates a failed login attempt

• It indicates a password change

• It indicates a cleared log event

What is the miter attack technique associated with the event rule ID 92652?

• Cross-Site Scripting

• Brute Force

• Pass the Hash

• SQL Injection

Why would an attacker clear event logs?

• To avoid detection

• To free up disk space

• To update the system

• To improve performance

What is the phase in the incident response process that involves creating a record of events and notifying security personnel?

• Detection

• Eradication

• Recovery

• Containment