Exam CS0-003 topic 1 question 119 discussion

C. Add data enrichment for IPs in the ingestion pipeline. Here's why: Data Enrichment: Data enrichment is the process of adding additional context and information to the data in your SIEM. By enriching the SIEM data with threat intelligence feeds that contain information about known-malicious IP addresses, you can quickly identify whether an IP address in an alert is associated with known threats. This process allows for real-time analysis and correlation of SIEM alerts with known threat indicators.

Data enrichment involves enhancing the data in the SIEM system with additional context, such as threat intelligence, before it's processed and analyzed. By adding data enrichment for IPs in the ingestion pipeline, you can check the IP address against threat intelligence feeds, known-malicious IP databases, and other security data sources in real-time. This enables quick identification of whether the IP address is associated with malicious activity.

Good job FoeMarc,I like your explanation.

I select "B" based upon definition and how they are used