What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

A. Process all alerts by running the respective playbook and link related incidents during post-processing

B. Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

C. Configure a pre-process rule to link related events as they are ingested

D. Manually go through the incidents created by the raw events and link related incidents








 

Suggested Answer: A

Community Answer: C



This question is in PCSAE Palo Alto Networks Certified Security Automation Engineer Exam
For getting Palo Alto Networks Certified Security Automation Engineer (PCSAE) Certificate




Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by Palo Alto Networks. 
Trademarks, certification & product names are used for reference only and belong to Palo Alto Networks.
The website does not contain actual questions and answers from Palo Alto Networks's Certification Exams.