CAS-005 · Question #86
The identity and access management team is sending logs to the SIEM for continuous monitoring. The deployed log collector is forwarding logs to the SIEM. However, only false positive alerts are being
The correct answer is C. The data is not being properly parsed. Proper parsing of data is crucial for the SIEM to accurately interpret and analyze the logs being forwarded by the log collector. If the data is not parsed correctly, the SIEM may misinterpret the logs, leading to false positives and inaccurate alerts. Ensuring that the log data
Question
The identity and access management team is sending logs to the SIEM for continuous monitoring. The deployed log collector is forwarding logs to the SIEM. However, only false positive alerts are being generated. Which of the following is the most likely reason for the inaccurate alerts?
Options
- AThe compute resources are insufficient to support the SIEM
- BThe SIEM indexes are 100 large
- CThe data is not being properly parsed
- DThe retention policy is not property configured
How the community answered
(40 responses)- A3% (1)
- B18% (7)
- C73% (29)
- D8% (3)
Explanation
Proper parsing of data is crucial for the SIEM to accurately interpret and analyze the logs being forwarded by the log collector. If the data is not parsed correctly, the SIEM may misinterpret the logs, leading to false positives and inaccurate alerts. Ensuring that the log data is correctly parsed allows the SIEM to correlate and analyze the logs effectively, which is essential for accurate alerting and monitoring.
Community Discussion
No community discussion yet for this question.