問題文
A security operations lead asks what the detection and response feature adds on top of the individual detections that the site already produces. Which option describes its main function?
選択肢
- Events from the activated sources are gathered and forwarded and the result is stored on the host that raised them.
- Events from the activated sources are gathered and correlated and the result is written to the rule table of the firewall.
- Events from the activated sources are gathered and counted and the result is shown as a rate for each interval.
- Events from the activated sources are gathered and correlated and the result is mapped to a public catalog of adversary behavior.