Following a recent and very large corporate merger, the number of log files an SOC needs to review has approximately tripled. The Chief Information Security Officer (CISO) has not been allowed to hire any more staff for the SOC, but is looking for other ways to automate the log review process so the SOC receives less noise. Which of the following would BEST reduce log noise for the SOC?
A) SIEM filtering
B) Machine learning
C) Outsourcing
D) Centralized IPS

Question

Quizplus · Accepted Answer

SIEM filtering can help reduce log noise by allowing the SOC to set rules and filters to only receive relevant alerts, thus reducing the amount of data they need to review.

Following a Recent and Very Large Corporate Merger, the Number