A SOC receives thousands of static-threshold alerts a day from its cloud workloads. Most are false positives, analysts have begun ignoring whole alert categories, and a recent credential misuse attack went unnoticed among the noise. Which approach best addresses this problem?
Select an answer to reveal the explanation.
Short Explanation
Static thresholds are like a smoke alarm that goes off every time you make toast; eventually you pull the battery. Behavioral baselining learns what normal looks like for each identity and workload, so it can whisper about the odd login instead of shouting about every spike. The trap is just turning the thresholds up, which mutes the real fire too.
Full Explanation
Intelligent monitoring uses machine learning and analytics to model normal behavior for users, service identities, hosts and network flows, then scores deviations such as an identity calling unfamiliar APIs, logging in from an unusual location or moving abnormal volumes of data. Because the baseline is specific to each entity, it suppresses routine variation that generates static-threshold noise while surfacing subtle anomalies like misuse of valid credentials, which fixed rules frequently miss. Raising thresholds reduces alert volume by blinding the SOC; the attack that slipped through would be even less likely to trigger. Disabling alerts for development and test accounts creates a blind spot attackers favor, since lower-environment credentials often provide a path into production. Hiring more analysts to triage the same low-quality alerts treats the symptom, raises cost and still leaves fatigue and missed detections in place. Exam caveat: AI-driven detection needs quality training data, tuning, a learning period and human review of results; it augments analysts rather than replacing them. Operational check: measure the false positive rate and mean time to detect before and after deployment, and confirm that anomaly scores are tuned per entity and routed to analysts with context.