Junior Security Analyst Intro | THM

This is a short walkthrough of Junior Security Analyst Intro from TryHackMe.

The lab itself is very brief as its an introductory of SOC teams and security analysts. The following questions will be related to using a mock SIEM tool

Task 3 — A day In the life of a Junior (Associate) Security Analyst

Question 2: What was the malicious IP address in the alerts?

Press enter or click to view image in full size

• 221.181.185.159

Firstly, this is seen as malicious because the connection attempt is unauthorized. Followed by this is a successful SSH connection from the same IP address that made the initial unauthorized attempt.

Question 3: To whom did you escalate the event associated with the…