An engineer must create a SIEM rule to test events and traffic for spikes and changes that occur in regular patterns to detect irregularities. Which rules achieve the desired results?

Question

Options

• Aanomaly
• Bbehavioral
• Cthreshold
• Davailability

• A
  2% (1)
• B
  88% (45)
• C
  4% (2)
• D
  6% (3)

Explanation

Behavioral rules are correct here because they establish a baseline of normal activity over time and then detect deviations from those established patterns - specifically designed to identify spikes and changes that occur in regular, recurring patterns, making them ideal for spotting irregularities in predictable traffic flows.

Anomaly rules (A) are close but focus on statistical deviations from a general baseline without necessarily accounting for regular patterns or rhythmic behavior over time - they flag outliers but don't model cyclical/periodic behavior as well as behavioral rules do. Threshold rules (C) simply trigger alerts when a specific numeric value is exceeded (e.g., 100 failed logins in 5 minutes), but they don't analyze patterns or trends over time. Availability rules (D) monitor whether systems and services are up or down, which is entirely unrelated to traffic pattern analysis.

Memory Tip: Think "Behavioral = Baseline + Pattern" - behavioral rules learn how something normally behaves over time, so when the rhythm changes, the alert fires. If you see words like "patterns," "regular cycles," or "baseline behavior" in a question, behavioral is your answer.

No community discussion yet for this question.