A SIEM analyst needs to establish a behavioral baseline for normal SSH login activity. Which metric combination is MOST useful for effective anomaly detection?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — d is correct because a comprehensive SSH baseline captures multiple dimensions — who logs in, from where, when, to what systems, and success rates — enabling detection of deviations in any dimension that may indicate brute force, credential stuffing, or unauthorized access. A is wrong because total connections and session duration alone miss geographic, temporal, and target system anomalies.
Full explanation below image
Full Explanation
D is correct because a comprehensive SSH baseline captures multiple dimensions — who logs in, from where, when, to what systems, and success rates — enabling detection of deviations in any dimension that may indicate brute force, credential stuffing, or unauthorized access. A is wrong because total connections and session duration alone miss geographic, temporal, and target system anomalies. C is wrong because unique username counts alone provide insufficient context for meaningful anomaly detection. B is wrong because SSH daemon version is a configuration detail, not a behavioral baseline metric.