A security operations center (SOC) team wants to spot insider threats by monitoring log data for unusual login times, excessive file access, and other deviations from normal employee activity across multiple systems. Which internal source would BEST enable the analyst to correlate these events and quickly detect abnormal user behavior patterns?
Vulnerability scanner reports
Endpoint detection and response (EDR) tool
Security Information and Event Management (SIEM) system
Logs from Security Information and Event Management (SIEM) systems are designed to aggregate and analyze security data from various sources, including user activity. This makes SIEM systems effective for identifying patterns of abnormal behavior or anomalies indicative of potential security threats. Endpoint detection and response (EDR) tools also provide valuable insights, but they focus mainly on activity occurring on individual endpoints rather than aggregating and correlating events from multiple systems. Network firewall logs and vulnerability scanner reports serve different purposes and are far less effective for discovering cross-platform user behavior anomalies.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What does a SIEM system do?
Open an interactive chat with Bash
Why is a SIEM better at identifying user behavior patterns than a firewall?
Open an interactive chat with Bash
How does a SIEM system detect abnormal patterns of user behavior?