Chapter 4 of 8 · EC-Council 312-39
Incident Detection and Triage
SIEM architecture, deployment, use cases, detection, AI rules, triage and reports.
- 6topics
- 28 minfast track
- 1diagrams and exhibits
- 25%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1SIEM Importance, Architecture and TypesLearn why a SOC needs a SIEM, how its collection, normalization and correlation components fit, and the pros and cons of each…Diagram5 min
- 2Deploying a SIEM and Managing Use CasesLearn how a SOC plans and deploys a SIEM, onboards and tunes log sources, and builds, tests and reviews SIEM use cases over their…5 min
- 3Incident Detection with SIEMLearn how a SIEM detects incidents with rule, anomaly and threat intel correlation, and the Windows event IDs behind common…5 min
- 4Using AI to Generate SIEM RulesLearn how SOC teams use generative AI to draft SIEM detection rules, the risks involved, and how to validate and test AI drafts…5 min
- 5Alert Triage and AnalysisLearn how SOC analysts triage alerts: validate true and false positives, enrich, prioritize by asset value, then escalate and…4 min
- 6SOC Dashboards, Visualization and ReportsLearn SOC dashboard types, the charts and KPIs such as MTTD and MTTR they show, and the operational, executive and compliance…4 min
About this chapter
What this chapter covers
Incident Detection and Triage is 25% of the EC-Council CSA 312-39 exam, tied with Incident Response as the largest chapter. It covers why a SOC needs a SIEM and how one is built, the types of SIEM solution, deploying a SIEM, managing use cases, detecting incidents with correlation rules, using AI to draft SIEM rules, triaging alerts, and the dashboards and reports a SOC produces.
Questions are single-answer multiple choice, often "Which of the following" and short named scenarios. You are asked what an alert, log entry or IoC means and what the next triage step is.
It has 9 outline topics, and six pages cover them.
How the topics fit together
The chapter follows an event from the log source to the report a manager reads.
The first pages build the SIEM and decide what it should detect. The later pages cover what analysts do with each alert and how the SOC shows its results.
When a question asks what a Tier I analyst does first with a new alert, the answer is almost always to validate it (true or false positive) before escalating or acting.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to name the next step for each short scenario before reading the answer. The exam often asks what to do first, or which tool fits.
Ready for more practice?
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.