Which of the following tools will analyze network logs in real time to report on suspicious log events?

The correct answer is C. SIEM. Security information and event management (SIEM) software provides a centralized repository for logs, audit events, and security device alerts to detect and notify admins of suspicious activity. For example, attackers can enable a backdoor on a compromised device that will…

Security and disaster recovery

Question

Options

ASyslog
BDLP
CSIEM
DHIPS

How the community answered

(32 responses)

A
3% (1)
B
3% (1)
C
88% (28)
D
6% (2)

Explanation

Security information and event management (SIEM) software provides a centralized repository for logs, audit events, and security device alerts to detect and notify admins of suspicious activity. For example, attackers can enable a backdoor on a compromised device that will provide them with undetected access for long periods of time; this problem is often solved by applying patches, but SIEM solutions may detect repeated abnormal login times to a server.

Topics

#SIEM#Log Analysis#Network Security#Real-time Monitoring

Community Discussion

No community discussion yet for this question.

Full SK0-005 Practice