How Should the SIEM Alert on the VM001 Attack?
Short answer
B Perform log correlation on the SIEM solution so related events across sources and timestamps become a single high-confidence VM001 attack alert.
Question
Later, the incident response team notices an attack was executed on the VM001 host. Which of the following should the security analyst do to enhance the alerting process on the SIEM platform?
Key Takeaways
The question tests whether you can distinguish raw log collection from alert-generation logic; the trap is assuming more log sources automatically produce better alerts.
SIEM log correlation combines discrete events across sources and timestamps into a single high-confidence alert. This page explains why correlation, not adding a new EDR log source, is the right fix when VM001 was attacked without a timely SIEM warning.
Common mistake: Many learners choose adding the EDR solution as a new log source (A), but extra telemetry alone does not correlate the separate SIEM events that already pointed to the VM001 attack.
Expert Analysis
Why the Answer Is Correct
Option B is correct because the scenario describes a SIEM that recorded events but did not produce a high-priority alert before the VM001 attack succeeded. Log correlation joins related events from different sources and timestamps into a single security incident, raising confidence and making the attack chain visible to analysts. That directly enhances the alerting process rather than just expanding ingestion. The VM001 host likely appeared in multiple discrete records that only become meaningful when correlated.
Why the Other Options Are Wrong
Option A expands visibility by adding EDR as a log source, but it does not fix the missed alert; the SIEM already had events. Option C assumes parsing is broken, yet poor parsing would usually cause malformed or dropped fields, not a silent failure to connect related VM001 events. Option D creates a narrower malware rule set, which may help with known malware but does not address the multi-event, cross-source correlation gap shown in this scenario.
Community Comment Notes
BWH9492 focused on the fact that the SIEM logged events separately over time but failed to raise an active, high-priority alert before VM001 was compromised. They described how "SIEM Log Correlation connects related, discrete log events" across sources and timestamps into a single high-confidence event. That aligns with the incident-response lesson: collection without correlation still leaves analysts without an actionable alert.
Exam Strategy
When a SIEM report shows events but no incident alert, ask whether the gap is collection, parsing, or correlation. Adding a source improves coverage, but correlation improves alert fidelity and is the usual answer when multiple discrete events describe one attack.
Frequently Asked Questions
Why is adding EDR as a new SIEM log source not the best fix for VM001?
When would improving SIEM parsing be the right answer?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
BWH9492 👍 1 Answered BThe SIEM logged these events separately over time, but it failed to raise an active, high-priority alert to warn analysts before an attack succeeded on VM001. SIEM Log Correlation connects related, discrete log events across different log sources and timestamps into a single, high-confidence security event or alert. Individual events logged separately without triggering an incident alert Implement Perform Log Correlation Engine Rules. Raw log fields missing or unreadable Improve Log Parsing.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.