Which of the following is NOT a core component of an SIEM solution?

Correlation is a core SIEM function that links disparate security events from various sources to identify patterns indicating potential threats.

Aggregation is a core SIEM function that collects and consolidates log and event data from numerous sources into a central repository.

Compliance is a key objective and output of SIEM solutions, as they generate reports and evidence necessary for meeting regulatory requirements.

Escalation describes the process of alerting and involving personnel when a security incident is detected, which is an action taken *after* an SIEM has identified a threat, rather than a built-in functional component of the SIEM system itself. SIEMs focus on detection and analysis, not the human response process.