A SOC analyst wants to improve the proactive detection of malicious emails before they are delivered to the destination inbox. Which of the following is the best approach the SOC analyst can…

UEBA (User and Entity Behavior Analytics) software focuses on detecting anomalous user or entity behavior within a network, which is not primarily designed for proactive email content scanning before delivery.

DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) are email authentication methods that verify the sender's legitimacy and prevent email spoofing. By validating these headers, an organization can proactively identify and quarantine emails that originate from unauthorized sources or have been tampered with, significantly reducing the chance of phishing and spam reaching inboxes.

EDR (Endpoint Detection and Response) systems monitor and respond to threats on endpoints after an email might have been delivered and interacted with, rather than proactively preventing email delivery.

DLP (Data Loss Prevention) platforms primarily prevent sensitive data from leaving the organization, not specifically for detecting inbound malicious emails before delivery.