Exam SY0-601 topic 1 question 379 discussion

Correlate > SIEM.

A SIEM system is designed to collect, analyze, and correlate log data from various sources within an organization's network, including endpoints, servers, firewalls, and other security devices. It provides real-time monitoring and analysis of security events, allowing security analysts to identify and respond to potential threats. In this case, the SIEM can collect logs from the various endpoints on the network that are communicating with the malicious domain. By correlating the activities across these endpoints, the SIEM can provide a comprehensive view of the beaconing activities and help identify the extent of the infection. It can also generate alerts or triggers based on predefined rules or patterns, enabling timely incident response and mitigation actions.

I go with B: SIEM entails - collection, aggregation and corellation

A SIEM system is designed to collect, analyze, and correlate log data from various sources within an organization's network, including endpoints, servers, firewalls, and other security devices. It provides real-time monitoring and analysis of security events, allowing security analysts to identify and respond to potential threats.

Trust.

B. SIEM