SOC › Module 5 › Lesson 5
Quiz — Rules
10 APPLY items on rule anatomy, Sigma, and tuning hygiene on $SOC_LAB.
Opening
Detection Rules — Module Quiz
Ten APPLY items. Name detection rule concepts on YOUR $SOC_LAB scenarios — never unauthorized prod deploy, stranger SIEM edits, or exploit cookbooks. Original Cyberlium. Next: Triage Process.
Knowledge Check
APPLY: Detection rule components include:
Multiple choice
Knowledge Check
APPLY: True or False: Sigma is vendor-neutral and maps to SPL/KQL.
True or False
Knowledge Check
APPLY: Rule tuning primarily aims to:
Multiple choice
Knowledge Check
APPLY: Tutorial mass-imports Sigma to production without review — you:
Multiple choice
Knowledge Check
APPLY: Sigma logsource must:
Multiple choice
Knowledge Check
APPLY: Good exclusion documentation includes:
Multiple choice
Knowledge Check
APPLY: Cyberlium NEVER allows:
Multiple choice
Knowledge Check
APPLY: True or False: MITRE tags in Sigma provide technique context for analysts.
True or False
Knowledge Check
APPLY: chmod 600 on rules notes means:
Multiple choice
Knowledge Check
APPLY: Next lesson after this quiz:
Multiple choice
Answer all 10 knowledge checks to continue. (0/10 answered)