Question
A security operations center (SOC) has a very high volume of logs and alerts. The manager proposes the implementation of a machine learning (ML) system to help with triage. Which of the following tasks is most suitable?
- A. Applying filters on specific alerts
- B. Automatically patching vulnerable systems
- C. Identifying and classifying alerts Correct
- D. Summarizing the content of alerts
Explanation
Triage is about sorting alerts by type and priority, and classification is a core strength of ML: a model trained on past alerts can identify and categorize new ones at volume, separating likely true positives from noise. Static filters are rule-based and need no ML, automatic patching is remediation rather than triage, and summarizing content is better suited to a generative language model and does not by itself prioritize alerts.
