An organization is struggling to differentiate threats from normal traffic and access to systems. A security engineer has been asked to recommend a system that will aggregate data and provide…

A web application firewall inspects and filters HTTP/S traffic destined for web applications but does not aggregate multi-source data or provide environment-wide threat visibility.

A Security Information and Event Management system ingests, normalizes, and correlates log and event data from endpoints, servers, network devices, and applications into a single platform. It provides dashboards, alerts, and behavioral analytics that allow security engineers to establish baselines and identify deviations indicative of malicious actors or compromised systems. This directly satisfies the requirement for a solution that aggregates data and produces metrics to differentiate threats from normal traffic.

An IPS monitors and blocks malicious network traffic in real time but is scoped to network-layer detection and does not aggregate logs or provide the broad analytics described.

A UTM device consolidates multiple perimeter security functions but operates at the network edge and does not aggregate data from internal systems or provide enterprise-wide behavioral metrics.

A file integrity monitor detects unauthorized changes to specific files and directories but has a narrow scope and cannot correlate data across multiple systems to identify broader threat patterns.