An organization wants to implement a threat hunting program. Which data source combination provides the MOST value for hunting advanced persistent threats that evade signature-based detection?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because network flow data reveals anomalous connection patterns and data volumes while endpoint telemetry captures attacker behavior — process creation, network connections, file writes — that bypasses signatures. Together they enable behavioral hunting.
Full explanation below image
Full Explanation
C is correct because network flow data reveals anomalous connection patterns and data volumes while endpoint telemetry captures attacker behavior — process creation, network connections, file writes — that bypasses signatures. Together they enable behavioral hunting. B is wrong because deny logs only show blocked traffic; APTs use allowed channels like HTTPS and DNS. A is wrong because spam statistics reveal phishing volume but not post-compromise behavior. D is wrong because physical access logs are useful for insider threat investigations but not APT behavioral hunting.