312-39V2: Certified SOC Analyst v2

A manufacturing company is deploying a SIEM system and wants to improve both its security monitoring and regulatory compliance capabilities. During the planning phase, the team chooses an output-driven approach, beginning with use cases that address unauthorized access to production control systems. They configure data sources and alerts specific to this use case, ensuring that they receive actionable alerts without excessive false positives. After validating its success, they proceed to use cases related to supply chain disruptions and malware detection.

Which of the following best describes the primary advantage of using an output-driven approach in SIEM deployment?