Logging and monitoring · Question 10 of 12
What does correlation mean in a SIEM?
1 answer is correct. Medium
Show answer
Answer
- D Events from several sources are linked
Explanation
Individual events often seem harmless: a failed login, a login from abroad, a large download. Together and in quick succession, they can indicate an attack. Correlation rules detect such patterns.