Question

A SaaS provider's SOC receives an alert that a customer's records were found for sale on a dark web forum. The affected data resides in a PostgreSQL database behind a public-facing web application. The web application logs, database query logs, and a WAF are all available. As the lead analyst investigating this potential data loss via the application vector, what is the MOST appropriate first investigative step?

Accepted Answer

Review the web application access logs and WAF events for anomalous request patterns, such as SQL injection strings, correlated to the timeframe of the suspected breach

Answer

Rebuild the web server from a known-good golden image to eliminate any attacker persistence

Answer

Immediately notify all affected customers under the 72-hour breach notification requirement

Answer

Reset all database service account credentials and rotate the application's API keys