Understanding the Question:
The question asks which tool is best for aggregating data from multiple systems to identify abnormal behavior.
Analyzing the Options:
A). Cyber threat intelligence:Provides information on potential threats but does not aggregate data from multiple systems for behavior analysis.
B). Anti-malware software:Focuses on detecting and removing malware, not aggregating data from multiple sources.
C). Endpoint detection and response (EDR):Monitors endpoints for suspicious activity but is more limited in scope compared to SIEM systems.
D). SIEM systems:Security Information and Event Management systems collect, aggregate, and analyze data from various sources to identify and respond to abnormal behavior.
SIEM Systems:SIEM systems are designed to aggregate and analyze security data from multiple sources such as network devices, servers, and applications. They provide real-time analysis of security alerts generated by hardware and software.
Functionality:SIEM systems use advanced analytics to correlate data from different sources and detect patterns that indicate abnormal behavior. This makes them highly effective in identifying and responding to security incidents.
References:
CRISC Review Manual, Chapter 3: Risk Response and Reporting, mentions the importance of centralized monitoring systems like SIEM for effective risk management.