Palo_Alto_Networks
PCSAE · Question #94
What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?
The correct answer is C. Configure a pre-process rule to link related events as they are ingested. See the full explanation below for the reasoning.
Question
What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?
Options
- AProcess all alerts by running the respective playbook and link related incidents during post-
- BIngest all raw events, run a custom script to find the relationship between them and proceed to
- CConfigure a pre-process rule to link related events as they are ingested
- DManually go through the incidents created by the raw events and link related incidents
How the community answered
(48 responses)- A4% (2)
- B10% (5)
- C83% (40)
- D2% (1)
Community Discussion
No community discussion yet for this question.