Exam 200-201 topic 1 question 53 discussion

No - This is a IDS/IPS log. Look at the Signature ID

Sig. ID is there, therefore the answer could be A: IDS

Correct ANS= A

The answer is D (IDS) The log entry contains information about a signature ID, source and destination IP addresses, source and destination ports, and a severity rating. These are characteristics typically found in IDS logs (Intrusion Detection System). IDS logs provide information about security events detected by an IDS system, which monitors network traffic for signs of unauthorized activity or security policy violations. On the other hand, proxy logs record client connections to a proxy server, NetFlow logs capture network traffic data, and syslogs are a type of system log that captures messages from various components of a computer system.

"Sig ID" typically refers to a Signature ID, which is a unique identifier assigned to a particular security threat or event by an intrusion detection or prevention system (IDS/IPS). A log message that includes a Sig ID would suggest that the message is related to an alert triggered by the IDS/IPS in response to a security event.

IDS and firewalls uses signatures.

Looks more like an IDS/IPS log to me. Syslog doesn't have a Signature ID field so it can't be that.

You also see the 5-tuple in IPS events, NetFlow records, and other event data. In fact, on the exam you may need to differentiate between a firewall log versus a traditional IPS or IDS event. One of the things to remember is that traditional IDS and IPS use signatures, so an easy way to differentiate is by looking for a signature ID (SigID). If you see a signature ID, then most definitely the event is a traditional IPS or IDS event. Cisco CyberOps Associate_P861 CBROPS 200-201 Official Cert Guide Omar Santos

OK - so what has the severity got to do with and IDS. Severity 6 is a syslog feature and means informational and represents a normal event. Why would a normal even have a sig id?

A should be the answer, signature ID.

SIG ID is present so IDS/IPS

a is corrects ids log

you are right there is the signature ID column, but the first column is Severity

Agreed.