From the course: CompTIA Cybersecurity Analyst (CySA+) (CS0-003) Cert Prep

Unlock the full course today

Join today to access over 24,200 courses taught by industry experts.

Endpoint symptoms

Endpoint symptoms

From the course: CompTIA Cybersecurity Analyst (CySA+) (CS0-003) Cert Prep

Start my 1-month free trial Buy for my team

Endpoint symptoms

“

- [Instructor] Endpoint devices are also great sources of information for cybersecurity analysts. Some of the symptoms of endpoint compromise are obvious. You might see antivirus alerts or intrusion prevention system warnings popping up on endpoints when they detect a potential security issue. Those symptoms definitely warrant investigation. Other symptoms may be less obvious, but just as important when conducting an incident investigation. Just as your physician monitors your vital signs, you should monitor the vital signs of your endpoints for indicators of compromise. The first vital statistic that you should monitor on an endpoint is CPU utilization. Processor consumption can tell you quite a bit about system performance. In addition to watching for anomalies in the amount of CPU being used system wide, you should also watch for individual processes that are using abnormally high CPU cycles. This might point you at malware or another compromise. For example, attackers might be…

Contents