During a pilot the SOC wants a correlation rule that fires only after a pattern repeats inside a fifteen-minute window, then emails the duty address and launches a scan of the offending host, with no traffic blocked while tuning continues. Which correlation policy configuration satisfies every requirement?
Select an answer to reveal the explanation.
Short Explanation
You pair the email alert and offending-host scan in a response group, with an event-count tracker that waits for repeats within fifteen minutes. Temporary host isolation would block traffic, a thirty-minute window misses the requirement, and a subnet scan does not target the offending host. Keep the policy enabled while tuning and verify the responses do not interrupt traffic.
Full Explanation
The configuration that meets every requirement uses an event-count tracker set to require repeats within fifteen minutes and a response group containing the email alert and scan of the offending host. Enabling the policy activates the correlation rule, while these specified responses do not block traffic, allowing tuning to continue without interruption. A response group that also includes temporary host isolation adds a containment action that blocks the host’s traffic, violating the pilot’s no-blocking condition. An event-count tracker with a thirty-minute interval has the required alert and host scan, but it does not enforce the stated fifteen-minute window; events spread across that longer interval could trigger the rule incorrectly. An email alert paired with an automatic subnet scan has the required timing, but a subnet scan does not launch the requested scan of the offending host and broadens the target. Exam caveat: the event threshold and its time window are distinct settings, so confirming the repeat count alone does not confirm the required interval. Practical check: test repeated events both inside and outside the fifteen-minute window, verify the duty email and host-specific scan launch, and confirm that no blocking or isolation response is enabled.