Which SIEM capability analyzes log data to identify suspected activities related to system compromise?

Which SIEM capability analyzes log data to identify suspected activities related to system compromise?

• A. Data Aggregation
• B. Log Retention
• C. System and Device Log Monitoring
• D. Object Access Auditing

Answer: (C)

System and device log monitoring is the activity of continuously watching logs from endpoints, servers, and network devices to spot signs of trouble. In a SIEM, this means real-time collection, normalization, and analysis of events from across the environment, then applying correlation rules and analytics to flag suspicious patterns that suggest a system has been or is being compromised. Think about what attackers do: unusual login activity, failed attempts that escalate to success, new or unexpected services starting, strange process behavior, or quick movement between machines. When these indicators appear in the logs and across multiple sources, the SIEM can generate an alert for investigators to respond. This capability is essential for recognizing potential compromises as they unfold, not just storing data or logging individual events. Data aggregation gathers data from many sources to make analysis possible, but it doesn’t by itself detect compromise. Log retention is about keeping logs for future investigation, not actively identifying ongoing threats. Object access auditing records who accessed specific objects, which is useful for compliance and forensics, but it doesn’t provide the broad, cross-system detection of suspicious compromise activity that system and device log monitoring delivers.

System and device log monitoring is the activity of continuously watching logs from endpoints, servers, and network devices to spot signs of trouble. In a SIEM, this means real-time collection, normalization, and analysis of events from across the environment, then applying correlation rules and analytics to flag suspicious patterns that suggest a system has been or is being compromised.

Think about what attackers do: unusual login activity, failed attempts that escalate to success, new or unexpected services starting, strange process behavior, or quick movement between machines. When these indicators appear in the logs and across multiple sources, the SIEM can generate an alert for investigators to respond. This capability is essential for recognizing potential compromises as they unfold, not just storing data or logging individual events.

Data aggregation gathers data from many sources to make analysis possible, but it doesn’t by itself detect compromise. Log retention is about keeping logs for future investigation, not actively identifying ongoing threats. Object access auditing records who accessed specific objects, which is useful for compliance and forensics, but it doesn’t provide the broad, cross-system detection of suspicious compromise activity that system and device log monitoring delivers.