A SOC receives threat intelligence indicating that an APT group uses a specific user-agent string in HTTP requests. Which SIEM query approach most efficiently detects this across all web proxy logs?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because a SIEM aggregates logs from all sources and allows indexed field searches, making detection of a specific user-agent across the entire enterprise fast and scalable. A is wrong because grepping raw syslog files is slow, does not scale across many servers, and is not sustainable for continuous detection.
Full Explanation
B is correct because a SIEM aggregates logs from all sources and allows indexed field searches, making detection of a specific user-agent across the entire enterprise fast and scalable. A is wrong because grepping raw syslog files is slow, does not scale across many servers, and is not sustainable for continuous detection. C is wrong because manual review of individual servers is time-intensive and cannot operate at scale or in real time. D is wrong because blocking a user-agent at the firewall would require HTTP inspection capability and is a prevention control, not a detection approach for historical analysis.