A hospital SOC sees one infected workstation raise repeated web-server attack events against six different internal servers inside a 10-minute window, landing as dozens of separate alerts in the Management Center. The lead wants one triage item per burst. Which correlation configuration produces that single item?
Select an answer to reveal the explanation.
Short Explanation
You need aggregation, not more logging: configure a correlation rule to count matching events in your window and suppress repeat correlation events for the burst. That gives the SOC one item to triage rather than an alert for every attack event.
Full Explanation
The required outcome is one triage item in the Management Center for the entire burst: events from one infected workstation targeting six servers within the specified ten-minute window must be correlated together, and repeat correlation events for that burst must be suppressed. Counting matching attack events in that window establishes the burst condition; suppression prevents each repeated match from creating another item. A SIEM aggregation rule may be a sound way to create one incident for analysts, but it operates in the SIEM and explicitly leaves the Management Center alerts in place, so it does not produce the requested single item there. A threshold keyed to both source and destination is useful when analysts need separate visibility by target, but it partitions this activity into per-server groups and can therefore create multiple triage items instead of one across all six servers. Grouping by signature for thirty minutes may reduce alert volume, but it uses the wrong time window: it can merge events from separate bursts occurring within that interval, rather than representing the specified ten-minute burst. Exam caveat: correlation grouping fields and suppression behavior can differ by product and rule type, so a nominally correct threshold may not imply the intended grouping. Practical check: test events from the workstation against all six destinations, then confirm the Management Center shows one item for the ten-minute burst and verify that a later burst outside the window creates a distinct item.