What is the primary value of a SIEM?
- A Correlating events across many sources to reveal patterns no single log shows
- B Storing logs cheaply
- C Blocking attacks automatically
- D Replacing endpoint protection
Answer
Correlating events across many sources to reveal patterns no single log shows
A single failed login is noise; failed logins across twenty systems from one source followed by a success is an attack.





