CSA (312-39) SOC Simulation Lab
Master data source selection for threat intelligence tracking. In this scenario, you must determine the optimal log source to accurately visualize external attacker infrastructure.
Scenario Context
You are the Senior Incident Responder reviewing a Splunk dashboard proposed by John, a junior Tier 1 analyst. John noticed a spike in malicious scanning and login attempts targeting your external infrastructure.
He suspects the traffic is being routed through the Tor anonymity network. To prove this to the CISO, he wants to build a geolocation heat map in Splunk showing the physical location of the incoming connections. However, he isn't sure which index or log source he needs to extract the correct fields from.
Security Environment
You pull up a raw sample of the inbound traffic hitting your perimeter to help him identify the telemetry fields needed for a GeoIP lookup:
--- PARSER BREAKDOWN --- src_ip: 185.220.101.14 (Known Tor Exit Node) http_user_agent: Mozilla/5.0... Firefox/115.0 (Standard Tor Browser UA) host_name: api.examrange.com (Targeted Asset)
Question
John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic is coming. Which of the following data source will he use to prepare the dashboard?
Tier 3 Analyst Insight
1. What is happening?
John is trying to enrich raw log data to create threat intelligence visualization. When an attacker routes traffic through Tor, the connection hits your perimeter from a "Tor Exit Node." The SIEM needs to extract the IP address of this node and compare it against a GeoIP database (like MaxMind) to plot it on a map dashboard.
2. Why the correct answer is correct (Option D)
Apache/Web Server logs with IP addresses and Host Name is the correct data source. The web server log captures the true Layer 7 external client IP (e.g., the Tor exit node). By mapping this IP, the SIEM can deduce geolocation. Furthermore, retaining the Host Name (e.g., `api.examrange.com`) is critical in multi-tenant or complex environments so the SOC knows exactly which service the Tor traffic is targeting.
3. Why the other options are wrong
A is incorrect because DHCP logs manage internal IP assignments (MAC to IP). They provide zero visibility into inbound, external web traffic.
B is incorrect because mapping IP to User-Agent provides no geolocation value. Furthermore, the Tor Browser explicitly standardizes its User-Agent string to prevent browser fingerprinting.
C is incorrect because DNS logs generally show internal recursive queries or external requests to your authoritative nameservers, neither of which directly maps the HTTP client IP to the application payload like a web server log does.
4. Real-world SOC application
If you were building this in Splunk, the actual SPL query would look something like this:
index=web sourcetype=apache_access | lookup tor_exit_nodes_list ip AS src_ip OUTPUT is_tor | search is_tor=true | iplocation src_ip | geostats count by Country
⚡ MINI LESSON: The "GeoIP Illusion" with Anonymity Networks
While John's dashboard will successfully map the Tor Exit Nodes, it's vital to remember the analyst limitation here: Geolocating a Tor Exit Node tells you where the traffic left the Tor network, not where the attacker actually lives. If your Splunk map shows 5,000 hits from Germany, it doesn't mean the threat actor is German—it simply means they are utilizing a German Tor relay. Use this data to block malicious infrastructure, not to attempt attribution.
Refine your Threat Hunting Skills
Practice identifying data sources and building detection logic in our advanced labs.
Explore more CSA simulations