Comprehensive and Detailed Explanation:
The question addresses how a security analyst can compare legitimate domains with typosquatted domains using a SIEM (Security Information and Event Management) system.
* Understanding Typosquatting:
* Typosquatting involves registering domains with minor spelling changes to deceive users (e.g., goog1e.com instead of google.com).
* Attackers use these domains in phishing emails or malicious ads.
* Security analysts need to match legitimate domains against typosquatted domains in real- time.
* Why Option B is Correct:
* A parser is a tool that extracts structured data from logs.
* In this case, a custom parser can identify domain names in network traffic logs and compare them to known typosquatted domains.
* This approach enables real-time detection of suspicious domains in SIEM.
* Why Other Options Are Incorrect:
* A (Cron job for updates): A cron job automates scheduled tasks but does not perform real- time matching. It is inefficient for immediate detection.
* C (Query to filter matching domains): A query alone can search for known domains, but it does not continuously enrich data or handle variations of domain names dynamically.
* D (Dashboard to show domain traffic percentages): A dashboard provides visualization, not active threat detection. It does not analyze logs for typosquatting.