2.3. Tools and Techniques for Detecting Malicious Activity

💡 First Principle: Detection tools amplify analyst capability — they scale what a single analyst can monitor, surface patterns invisible to manual review, and automate initial response — but they only detect what they're configured to look for in data they're configured to collect.

Every tool has a scope, a data dependency, and a tuning requirement. A SIEM with no correlation rules generates raw data, not alerts. An EDR without behavioral analysis detects known malware but misses novel techniques. Understanding what each tool does — and what it cannot do — is the foundation of effective tool selection and SOC design. The exam tests this constantly.

⚠️ Common Misconception: SIEM and SOAR are often used interchangeably in conversation, but they do fundamentally different jobs. SIEM sees the problem (aggregates, correlates, alerts). SOAR acts on the problem (automates response steps). Having a SIEM doesn't mean you have response automation.