CISM: Certified Information Security Manager

By Isaca · Question Mode

QuestionQ16

VerifiedInformation Security Program

An organization has acquired a security information and event management (SIEM) tool. Which of the following is MOST important to consider before implementing it?

Explanation

A SIEM must be configured to ingest and analyze events from the relevant security controls and systems. Identifying the controls to be monitored establishes the necessary log sources and enables meaningful detection, correlation, and alerting.

Community Discussion

No comments yet. Be the first to start the discussion!