Question

A security manager wants to improve the organization's ability to detect intrusions early. The SIEM currently generates thousands of alerts daily, but most are false positives, and a recent breach went undetected for weeks because malicious activity blended in with normal traffic. Which action would MOST effectively improve the organization's detection capability?

Accepted Answer

Establish baselines of normal system and network behavior to enable anomaly-based detection and correlation

Answer

Increase the retention period of SIEM logs to support future forensic investigations

Answer

Add more signature-based detection rules to the SIEM to catch additional known threats

Answer

Escalate every SIEM alert to the incident response team for manual review