A SIEM Can Be Effectively Used to Identify Active Threats

A SIEM can be effectively used to identify active threats from internal systems by monitoring/correlating events that occur

A) when no one is logged in; for example, after hours or on weekends.
B) across an unusual range of ports or destinations; for example, all high ports.
C) irregularly; for example, only on Fridays, or only at end-of-quarter.
D) in accordance with expected systems use.