Exam 300-710 topic 1 question 98 discussion

The Custom Analysis widget (Option D) allows for creating tailored views and reports based on specific criteria, which can be very useful for various types of analysis. However, it is not specifically designed for correlating malicious activity with users. The Correlation Events widget (Option B) is specifically intended to provide visibility into events triggered by correlation rules, which are designed to detect and track malicious activities. This makes it the most suitable choice for correlating malicious activity with a user on the Cisco Firepower dashboards.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/710/management-center-admin-71/events-correlation-compliance.html user activity information can be seen from correlation event widget optionally.

The Correlation Events widget should be configured to provide visibility of malicious activity correlated with a user on the Cisco Firepower dashboards.

Correct answer is: D

Only D, on that widget we can find "Malware" and "User"

I think A, fits best here

My choice is answer D. https://www.cisco.com/c/en/us/td/docs/security/firepower/622/configuration/guide/fpmc-config-guide-v622/dashboards.html#ID-2206-00000283

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/configuration/guide/fpmc-config-guide-v67/dashboards.html#ID-2206-00000283 The Correlation Events widget shows the average number of correlation events per second, by priority. D - right answer