You are a SOC Analyst.
You receive an alert:
• Multiple failed logins
• Followed by a successful login
• New geographic location
• Privileged account
What do you do first?
A. Reset password
B. Investigate logs
C. Disable account
D. Ignore alert
Drop your answer in comments ↓
0 Comments