Which SIEM capability provides static and dynamic monitoring of enterprise systems and networks and analyzes log data to identify suspected activities related to system compromise?

Which SIEM capability provides static and dynamic monitoring of enterprise systems and networks and analyzes log data to identify suspected activities related to system compromise?

• A. Data Aggregation
• B. Object Access Auditing
• C. Log Retention
• D. System and Device Log Monitoring

Answer: (D)

Monitoring and analyzing logs from enterprise systems and network devices in real time and over time is essential for spotting signs of compromise. System and Device Log Monitoring collects logs from servers, endpoints, network gear, and security appliances, then applies correlation and analytics to surface suspicious patterns such as failed login attempts, unusual privilege changes, lateral movement, unexpected command execution, or beaconing to external hosts. This combination of static (baseline configurations and states) and dynamic (runtime events) oversight enables the SIEM to detect both anomalies and active attacks, triggering alerts for incident response. Other options focus on merely gathering data (data aggregation), auditing access to resources (object access auditing), or simply retaining logs (log retention) without the ongoing monitoring and analytic capability needed to identify compromises.

Monitoring and analyzing logs from enterprise systems and network devices in real time and over time is essential for spotting signs of compromise. System and Device Log Monitoring collects logs from servers, endpoints, network gear, and security appliances, then applies correlation and analytics to surface suspicious patterns such as failed login attempts, unusual privilege changes, lateral movement, unexpected command execution, or beaconing to external hosts. This combination of static (baseline configurations and states) and dynamic (runtime events) oversight enables the SIEM to detect both anomalies and active attacks, triggering alerts for incident response. Other options focus on merely gathering data (data aggregation), auditing access to resources (object access auditing), or simply retaining logs (log retention) without the ongoing monitoring and analytic capability needed to identify compromises.