GCED Exam Dumps : GIAC Certified Enterprise Defender

private

mib

open

public

The pass action simplifies some filtering by specifying what to ignore.

The pass action passes the packet onto further rules for immediate analysis.

The pass action serves as a placeholder in the snort configuration file for future rule updates.

Using the pass action allows a packet to be passed to an external process.

The pass action increases the number of false positives, better testing the rules.

Verify the root cause of the incident and apply any missing security patches.

Install or reenable host-based firewalls and anti-virus software on suspected systems.

Search for sources of data and information that may be valuable in confirming and containing an incident.

Disconnect network communications and search for malicious executables or processes.