The city SOC needs 24/7 visibility into wireless threats. How should WIDS alerts be handled?
Select an answer to reveal the explanation.
Short Explanation
Wireless alarms that live on one laptop are like a fire bell in a locked closet. Pipe the important WIDS hits into the city SIEM so the SOC sees them around the clock. Noise without triage just trains people to ignore the bell.
Full Explanation
When the city SOC needs 24/7 visibility into wireless threats, prioritized WIDS/WIPS alerts should forward into the municipal SIEM for continuous monitoring and correlation with wired, endpoint, and identity events. Wireless attacks often accompany broader incidents; keeping RF alerts off the SOC’s primary console guarantees slow response and missed context during nights and weekends. Civic SOCs already live in SIEM workflows—meet them there with triage-ready wireless events rather than isolated RF tools that only one engineer understands.
Keeping WIDS events only on a laptop that one engineer checks when free is not continuous monitoring and fails after-hours coverage. Emailing every beacon frame to the mayor’s office without triage creates noise and political fatigue. Storing alerts on removable media and shredding them monthly destroys detection history needed for investigations.
Exam caveat: forward prioritized, actionable alert classes—not raw frame dumps—or the SIEM and analysts drown in volume. Operational check: confirm critical WIPS categories reach SIEM with severity mapping, generate a test rogue or deauth alert, and verify SOC playbook acknowledgement within the expected SLA.