AI assists signature matching across EDR alerts during a ransomware wave on city endpoints. Which AI-assisted detection use is this?

AI assisting signature matching across EDR alerts during a ransomware wave on city endpoints is AI-assisted signature matching to correlate and identify known malicious patterns at scale because the technique helps analysts connect high-volume endpoint alerts to known bad indicators quickly. Domain 3 detection-assistance uses AI to amplify correlation during outbreaks when municipal SOC capacity is saturated. Ransomware waves generate noisy, repetitive telemetry that benefits from assisted pattern matching tied to EDR evidence.

AI-assisted signature matching to flag anomalous endpoint activity indicating novel threats fails because the scenario involves correlating known malicious patterns through signature matching, not detecting novel threats through anomaly analysis, which signature matching cannot do. AI-assisted signature matching to execute suspicious files and observe malicious behavior fails because the activity described matches signatures across existing EDR alerts rather than executing files in a sandbox to observe behavior, which signature matching does not perform. AI-assisted signature matching to enrich EDR alerts with external threat actor context fails because the core task is signature correlation of known bad indicators, not enriching alerts with external threat actor context.

Exam caveat: signature-oriented assistance can miss novel tradecraft; pair it with behavioral analytics and human hunt rather than assuming known signatures cover the campaign. Operational check: keep EDR deployed and healthy, feed confirmed IoCs into the assisted matcher, require analyst confirmation before mass containment actions, and measure false-positive rate on municipal gold-image baselines during the wave.