Exam SY0-601 topic 1 question 562 discussion

A SIEM is a centralized logging and monitoring solution that collects, analyzes, and correlates log data from various sources within an organization's network and security infrastructure. It helps security analysts to gain visibility into security events and incidents by aggregating and correlating logs from multiple systems and devices. In the scenario described, the EDR system and firewall are both generating logs that provide valuable information about the incident. By using a SIEM, the analyst can collect and correlate the logs from these different sources to get a comprehensive view of the incident. The SIEM will help the analyst identify patterns, anomalies, and potential indicators of compromise that may not be immediately apparent when reviewing individual logs in isolation.

Basically if you see the word 'Correlated' in the question, the answer is SIEM.

Comptia seems to be fixated on SIEM. Answer is D

Correlated = SIEM

The best tool to assist the analyst is a SIEM (Security Information and Event Management). A SIEM is a security solution that provides real-time analysis of security alerts generated by network hardware and applications. It can help the analyst correlate logs from multiple sources and identify the source of the incident.