An organization wants to enhance its security posture by implementing a control that passively monitors network traffic, with the intention of detecting potentially malicious activity and alerting security teams. Which of the following options is the BEST choice that fits the description of this desired control?
Periodic white-box testing of the network infrastructure by an internal security team
Automated aggregation of security logs to enable after-the-fact analysis of unusual activity
A network tap installed to create a mirrored copy of the ingress and egress traffic for later review
An intrusion detection system (IDS) configured to analyze and alert on anomalous traffic patterns