I started with auth logs and worked outward, endpoint telemetry, network flow data, threat intel feeds, maybe identity provider logs if it's SSO.
Start by outlining a systematic investigation process: gather evidence from multiple data sources to build a timeline, then correlate events to determine if the login is malicious. Emphasize that you would consider the context of NASA's environment, such as high-security requirements and potential nation-state threats.
Pro tip: Mention that you would also check for related alerts or anomalies in other systems, as a single suspicious login might be part of a larger attack. Additionally, highlight the importance of documenting your findings and following incident response procedures.
Review the SIEM alert to understand the user, source IP, timestamp, and any other relevant information. This will guide which data sources to query.
Examine authentication logs from the target system (e.g., Windows Event Logs, Linux auth.log) to verify the login attempt and see if it succeeded or failed.
Analyze network logs (firewall, proxy, NetFlow) to see if the source IP is known malicious, if there are other connections from that IP, and if data exfiltration occurred.
Look at endpoint detection and response (EDR) data or host-based logs to see what actions the user took after login, such as privilege escalation or file access.
Review IAM logs (e.g., Active Directory, Okta) for unusual group changes, MFA bypass, or other signs of account compromise.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.