Which of the Enterprise Security frameworks provides additional automatic context and correlation to fields that exist within raw data?

Question

Options

• AAsset and Identity
• BThreat Intelligence
• CAdaptive Response
• DRisk

• A
  93% (38)
• B
  5% (2)
• C
  2% (1)

Explanation

Asset and Identity (A) is correct because this framework automatically enriches incoming events by correlating raw fields - such as IP addresses or usernames - against a stored asset and identity database. It appends additional context like business unit, location, priority, and owner directly to events, without any analyst action required.

Threat Intelligence (B) matches events against known indicators of compromise (IOCs), but its purpose is detection/flagging, not automatic field enrichment across raw data.

Adaptive Response (C) is an action framework - it triggers workflows and automated responses to notable events after detection. It doesn't add context to raw data fields.

Risk (D) assigns and accumulates risk scores to assets and identities over time; it calculates exposure rather than correlating contextual metadata onto raw events.

Memory tip: Think "A = Automatically adds context" - Asset and Identity is the framework that knows who and what every field refers to, so it fills in the blanks automatically.

No community discussion yet for this question.