問題文
A weekly report shows 40,000 cloud events, 120 detections, and 6 threats for the same period. A reviewer says the numbers must be wrong because they do not agree. How should this be answered?
選択肢
- The numbers describe three different stages and are expected to decrease at each one, since only some activity matches a rule and only some matches correlate into a situation worth acting on.
- The figures should agree, so the mismatch indicates that ingestion stopped partway through the period.
- The threats figure should equal the detections figure whenever correlation is working correctly, and a smaller number means that some detections were dropped in correlation.
- The detections figure is the only meaningful one, because cloud events are internal bookkeeping and threats are a presentation layer on top of the same records.