How Should the SIEM Alert on the VM001 Attack?
A security analyst is reviewing a SIEM and generates the following report:
Later, the incident response team notices an attack was executed on the VM001 host. Which of the following should the security analyst do to enhance the alerting process on the SIEM platform?
Community Insight
The question tests whether you can distinguish raw log collection from alert-generation logic; the trap is assuming more log sources automatically produce better alerts.
SIEM log correlation combines discrete events across sources and timestamps into a single high-confidence alert. This page explains why correlation, not adding a new EDR log source, is the right fix when VM001 was attacked without a timely SIEM warning.
Many learners choose adding the EDR solution as a new log source (A), but extra telemetry alone does not correlate the separate SIEM events that already pointed to the VM001 attack.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is correct because the scenario describes a SIEM that recorded events but did not produce a high-priority alert before the VM001 attack succeeded. Log correlation joins related events from different sources and timestamps into a single security incident, raising confidence and making the attack chain visible to analysts. That directly enhances the alerting process rather than just expanding ingestion. The VM001 host likely appeared in multiple discrete records that only become meaningful when correlated.Why the Other Options Are Wrong
Option A expands visibility by adding EDR as a log source, but it does not fix the missed alert; the SIEM already had events. Option C assumes parsing is broken, yet poor parsing would usually cause malformed or dropped fields, not a silent failure to connect related VM001 events. Option D creates a narrower malware rule set, which may help with known malware but does not address the multi-event, cross-source correlation gap shown in this scenario.Community Comment Notes
BWH9492 focused on the fact that the SIEM logged events separately over time but failed to raise an active, high-priority alert before VM001 was compromised. They described how "SIEM Log Correlation connects related, discrete log events" across sources and timestamps into a single high-confidence event. That aligns with the incident-response lesson: collection without correlation still leaves analysts without an actionable alert.Exam Strategy
When a SIEM report shows events but no incident alert, ask whether the gap is collection, parsing, or correlation. Adding a source improves coverage, but correlation improves alert fidelity and is the usual answer when multiple discrete events describe one attack.
Frequently Asked Questions
Why is adding EDR as a new SIEM log source not the best fix for VM001?
EDR telemetry can improve visibility, but it does not combine the separate events the SIEM already logged. The missed alert points to a correlation gap, not a missing source.
When would improving SIEM parsing be the right answer?
Improving parsing helps when fields are malformed, mislabeled, or dropped before rules can evaluate them. Here the report shows events were recorded, so the failure is alert correlation.