Firewall, endpoint and identity systems each generate alerts reviewed by separate teams. A recent intrusion was missed because related events across those systems were never linked. Which capability would BEST address this?
Select an answer to reveal the explanation.
Short Explanation
Each team was holding one puzzle piece and nobody saw the picture. You need something that pulls the pieces onto one table, and that's correlation in a SIEM. More alerts per tool just gives each team a bigger pile of disconnected pieces.
Full Explanation
The failure described is one of correlation: individual events, each unremarkable on its own, formed an attack pattern only when viewed together. A security information and event management platform aggregates logs from diverse sources, normalizes them and applies correlation rules so that, for example, an unusual authentication followed by a firewall connection and a new endpoint process can be recognized as one sequence. That supports timely identification and a consistent triage process across teams. Adding signatures to each standalone tool increases the number of isolated alerts but does not link them, and it may worsen workload for the separate teams. Longer retention on each system helps later investigation, yet the records would still sit in separate places without anyone connecting them in time to detect the intrusion. A data loss prevention tool at the email gateway addresses one exfiltration channel and is unrelated to linking events across firewall, endpoint and identity sources. Exam caveat: at the management level, the SIEM is valued for visibility and correlation, and its benefit depends on onboarding the right sources and maintaining rules. Operational check: confirm the critical log sources are onboarded, time-synchronized and covered by correlation use cases tied to known risks.