The municipal SOC needs one place that collects firewall, Active Directory, and endpoint logs and correlates them into security events. Which tool best matches that purpose?
Select an answer to reveal the explanation.
Short Explanation
A SIEM is the city's security switchboard—it pulls firewall, directory, and endpoint logs into one place and correlates the story. A lobby guestbook or yearly spreadsheet cannot do that job.
Full Explanation
Security information and event management (SIEM) platforms aggregate logs from diverse sources and correlate events to support detection and investigation. Municipal SOCs rely on that centralization for visibility across firewalls, identity systems, and endpoints. Non-technical or infrequently updated artifacts do not provide real-time security event correlation.