3Host-Based Analysis

• 3.1Endpoint technologies

  Covers the roles of host-resident HIDS (host-based IDS), antimalware/antivirus (AV), and the host firewall, and the difference between signature/rule-based and behavioral/predictive (predictive AI) based detection foundations, framed as the SOC judgment of "which technology caught this alert" and "which method works against known vs. unknown threats."

• 3.2Identifying OS components (Windows/Linux)

  Maps the Windows components that matter in an investigation scenario (processes/services, the registry, event logs, scheduled tasks, tasklist/netstat) to the Linux components (processes/daemons, systemd, /etc config, /var/log logs, cron, ps), framed as the investigative judgment of "which OS component reveals this artifact."

• 3.3Attribution and artifacts

  Covers the role and objects of attribution in an investigation—the assets to protect, the threat actor, IoCs (indicators of compromise) that are traces of a breach that already happened, IoAs (indicators of attack) that are signs of an attack in progress, and the chain of custody that underpins evidence reliability—framed as the judgment of "is this artifact after-the-fact or in-progress" and "what must be recorded for it to hold up as evidence."

• 3.4Types of evidence

  Covers distinguishing types of evidence from given logs—best evidence that most directly proves a fact, corroborative evidence that reinforces other evidence, and indirect (circumstantial) evidence that does not directly show a fact but lets one infer it from circumstances—framed as the judgment of "what, and how far, does this log prove."

• 3.5Log interpretation and malware analysis output

  Covers the ability to read events from OS, application, and command-line logs and from records that SIEM/SOAR aggregate and automate, the concept of the detonation chamber/sandbox that runs a sample in an isolated environment, and the judgment of leveraging its analysis output (hashes, URLs, system/event/networking information) as IoCs.