Following the merger of two large companies the newly combined security team is overwhelmed by the volume of logs flowing from the IT systems. The company's data retention schedule complicates the…

Question

Options

• AForward logs to both a SlEM and a cheaper longer-term storage and then delete logs from the
• BReduce the log volume by disabling logging of routine maintenance activities or failed
• CSend logs to a SlEM that correlates security data and store only the alerts and relevant data
• DMaintain both companies' logging and SlEM solutions separately but merge the resulting alerts

• A
  5% (1)
• B
  10% (2)
• C
  81% (17)
• D
  5% (1)

Explanation

After a merger, the combined log volume is unmanageable and must satisfy a months-long retention requirement. A SIEM (Security Information and Event Management) system ingests logs, correlates events, identifies patterns, and distills them into meaningful alerts and relevant contextual data. Storing only the correlated alerts and relevant data dramatically reduces storage volume while preserving the security intelligence needed for incident investigation and compliance. Option A (SIEM plus cheap storage) spreads data across two systems but the truncated description implies deleting from one store, creating gaps. Option B reduces log coverage, creating blind spots. Option D maintains two separate, redundant systems, which does not address the overload problem and increases operational complexity.

No community discussion yet for this question.