This question aligns with CHFI v11 objectives under Procedures and Methodology , specifically event correlation and analysis techniques used to investigate complex incidents. Event correlation is essential for transforming large volumes of logs and alerts into meaningful incident narratives. CHFI v11 describes multiple correlation approaches, each suited to different investigative needs.
The graph-based approach models systems, applications, users, and network components as nodes , while relationships such as dependencies, communications, or trust relationships are represented as edges . By constructing such graphs, investigators can visualize how events propagate across interconnected systems, identify attack paths, and determine how a compromise in one component impacts others. This approach is particularly effective in analyzing lateral movement, dependency-based failures, and multi-stage attacks in enterprise environments.
Rule-based approaches rely on predefined conditions, codebook-based approaches match patterns against known attack templates, and neural network-based approaches focus on anomaly detection using machine learning. While these are valuable, only the graph-based approach explicitly represents system dependencies and relationships in a node-edge structure. Therefore, consistent with CHFI v11 event correlation methodologies, the correct answer is Graph-Based Approach .