312-39V2: Certified SOC Analyst v2

Katie works as a SOC analyst in the Cyber Security department of the international Financial Corporation INT FIN Corp. She is responsible for monitoring logs in real time to detect potential security threats.

As part of the incident-response plan, her team needs functionality that continuously scans logs for anomalies, identifies suspicious activity, sends notifications when predefined security thresholds are met, and generates incidents or issues tickets to ensure immediate response and mitigation. It must provide critical details, including the event type, its duration, the affected device, and its OS version.

Which function should she configure to accomplish this?