A company stores engineering documents in a cloud file service. A post-incident review shows that an insider downloaded several gigabytes between 1 a.m. and 3 a.m. over two weeks; the access events were logged the whole time, but no one noticed. What should the security team implement to detect this pattern in the future?
Select an answer to reveal the explanation.
Short Explanation
Logs nobody reads are like a smoke detector with the batteries out. You already had the evidence; what you didn't have was something watching it and yelling when a user pulled gigabytes at 2 a.m. Watch for the trap answers that store more or protect more but still never raise an alarm.
Full Explanation
Collecting data events is only half of auditability; the events must be analyzed in time to act. Feeding file access events into a SIEM lets the team correlate them with identity and network data, build a behavioral baseline for each user or group, and alert on deviations such as abnormal transfer volume, unusual hours or access to rarely used folders. User and entity behavior analytics in the SIEM is exactly suited to slow exfiltration that stays under simple thresholds. Longer retention helps reconstruct an incident after discovery but does nothing to shorten the time to detection, which was the failure here. Encrypting documents at rest protects against theft of the storage media or provider-side exposure, yet an authorized insider downloading through the service receives decrypted content, so encryption does not reveal the behavior. A quarterly manual review is too infrequent and too labor-intensive to catch a two-week pattern while it is happening. Exam caveat: detection controls are distinct from preventive ones such as DLP; this scenario asks for detection of activity already permitted by access rights. Operational check: replay the incident's log window through the new rules and confirm an alert fires within hours, then tune thresholds to keep false positives manageable.