An IT organization has recently suffered multiple data breaches.

SIEM systemsconsolidate logs and events from across the enterprise and apply behavior analysis and correlation rules to detect suspicious activity, including lateral movement, brute force, and privilege escalation.

NIST SP 800-137 (Information Security Continuous Monitoring for Federal Information Systems and Organizations):

“SIEM solutions provide security teams with insight into potentially malicious activity and enable proactive incident detection and response.”

????WGU Course Alignment:

Domain:Security Operations and Monitoring

Topic:Utilize SIEM for real-time user behavior analysis