Which stage of continuous monitoring involves adding data, creating detections, and building drilldowns?

Question

Options

• AImplement and Collect
• BEstablish and Architect
• CRespond and Review
• DAnalyze and Report

• A
  93% (26)
• B
  4% (1)
• D
  4% (1)

Explanation

Option A (Implement and Collect) is correct because this stage is where you actually build out your monitoring infrastructure - ingesting data sources, writing detection rules, and creating drilldowns that let analysts pivot from alerts into deeper investigation views. It's the "do the work" stage where architecture becomes operational.

Option B (Establish and Architect) is the planning and design phase - you're defining what to monitor, what tools to use, and how the system should be structured, not yet adding data or building detections.

Option C (Respond and Review) comes after detections fire - it covers triaging alerts, taking action on incidents, and reviewing the effectiveness of your monitoring program.

Option D (Analyze and Report) focuses on interpreting collected data, measuring outcomes, and communicating findings to stakeholders - consuming the results, not building the mechanisms.

Memory tip: Think of "Implement and Collect" as the construction crew - they're laying pipe (ingesting data), installing alarms (detections), and wiring the control panel (drilldowns). The other stages are the blueprint (Establish), the inspection report (Analyze), and the emergency response team (Respond).

No community discussion yet for this question.