A healthcare SOC wants an early warning when a workstation first contacts an external address on the Security Intelligence list set to Monitor, then starts scanning internal subnets later the same day. Both signals are logged today but sit in different views, so nobody sees the sequence. Which correlation design raises one alert for that workstation?
Select an answer to reveal the explanation.
Short Explanation
You can connect the dots with correlation: use the monitored external contact as the base event, then track later internal connections from that same workstation. Configure the rule to raise one alert when the sequence occurs, so your SOC sees the whole story at once.
Full Explanation
The correct design correlates events across time and views: the monitored external contact is the base event, and later internal connections are associated with the same workstation. Configuring the rule to generate one alert lets the SOC see the sequence as a single signal rather than separately reviewing two event streams. A rule that starts with the internal scan and waits for a monitored contact afterward reverses the required chronology; it may find both event types, but it will not detect the stated contact-then-scan sequence. A daily query grouped by workstation is a reasonable way to summarize logged events and can avoid duplicate alerts, but merely finding both types within a day does not establish which came first, so it can alert on the opposite order as well. Grouping the correlation by external destination can detect related activity, but it does not reliably bind the later internal connections to the workstation that made the monitored contact; it can combine activity from different workstations or split one workstation’s activity across destinations. Exam caveat: correlation engines differ in whether they support explicit event ordering, time windows, and alert deduplication, so verify the platform’s rule semantics rather than relying on the term “correlation” alone. Practical check: replay a workstation’s contact-then-scan events alongside reversed-order and second-workstation cases, and confirm only the intended sequence produces one alert.