Question
Which of the following tools will analyze network logs in real time to report on suspicious log events?
- A. Syslog
- B. DLP
- C. SIEM Correct
- D. HIPS
Explanation
A SIEM (security information and event management) system collects logs from many sources, correlates them in real time and raises alerts on suspicious events. Syslog only transports and stores log messages without analyzing them. DLP looks for sensitive data leaving the organization, and a HIPS protects a single host rather than analyzing network logs.
