An MSSP customer forwards only alerts and does not include session records. Which question can those alerts answer that session data cannot answer on its own?
Select an answer to reveal the explanation.
Short Explanation
A referee's whistle is not a recording of the play. You can learn from alerts that a product already judged the activity malicious, and session data never makes that judgment. The trap is expecting file bytes, a long-term volume baseline, or the laptop owner's name.
Full Explanation
Alert data is a judgment. Session data is a conversation summary without that verdict. A customer who sends only alerts can show whether a product already called the activity malicious, and cannot answer questions that need bytes, a baseline, or an inventory. The question alerts can answer, and session data cannot, is That a security product already judged the activity malicious and raised an alert. Session records can show the flow and still leave the malicious-or-not decision unmade. The exact bytes of any file that moved during the activity the customer flagged require content the alert does not include. The long-term volume baseline that describes this customer's normal traffic is statistical data built over time, not a single judgment. The name of the employee who owns the laptop in the customer's asset inventory comes from asset context, not from the alert the customer forwarded. Exam caveat: an alert's value is the verdict and the signature or rule behind it, and forwarding alerts alone does not forward file bytes or the owner record. Operational check: read the signature or rule name on the alert for the judgment, then ask the customer for session data or the asset record only for the questions those alerts cannot cover.