The city SOC needs 24/7 visibility into wireless threats. How should WIDS alerts be handled?
Select an answer to reveal the explanation.
Short Explanation
Wireless alarms that live on one laptop are like a fire bell in a locked closet. Pipe the important WIDS hits into the city SIEM so the SOC sees them around the clock. Noise without triage just trains people to ignore the bell.
Full Explanation
Integrating WIDS/WIPS events with a SIEM gives the SOC continuous visibility, correlation with other security telemetry, and durable alerting workflows. Ad-hoc local review on a single engineer’s workstation does not meet 24/7 municipal monitoring expectations. Flooding executives with unfiltered beacons creates alert fatigue without improving response. Discarding wireless alerts on a fixed schedule destroys forensic and operational value.