A SIEM analyst needs to establish a behavioral baseline for normal SSH login activity. Which metric combination is MOST useful for effective anomaly detection?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — d is correct because a comprehensive SSH baseline captures multiple dimensions — who logs in, from where, when, to what systems, and success rates — enabling detection of deviations in any dimension that may indicate brute force, credential stuffing, or unauthorized access. A is wrong because total connections and session duration alone miss geographic, temporal, and target system anomalies.
Full Explanation
D is correct because a comprehensive SSH baseline captures multiple dimensions — who logs in, from where, when, to what systems, and success rates — enabling detection of deviations in any dimension that may indicate brute force, credential stuffing, or unauthorized access. A is wrong because total connections and session duration alone miss geographic, temporal, and target system anomalies. C is wrong because unique username counts alone provide insufficient context for meaningful anomaly detection. B is wrong because SSH daemon version is a configuration detail, not a behavioral baseline metric.