An organization has a SIEM that generates high-quality alerts on privilege escalation events. The on-call analyst typically responds by: (a) checking the affected user in the identity provider, (b) disabling the account if unauthorized, (c) opening a ticket. The team wants this response to happen automatically within 30 seconds of alert generation, without human delay. Which technology is the correct addition?

A security engineer is drafting a log-level policy for a new microservice. Consider the following three statements about production logging:

I. DEBUG-level logs should be shipped to the SIEM along with WARN and ERROR because more data enables better investigations.
II. Authentication failures should be logged at ERROR level, not INFO, because every failure is a potential attack indicator.
III. CRITICAL-level events should both ship to the SIEM and page the on-call analyst.

Which statement(s) are correct?

A SIEM engineer writes the following correlation rule to alert on data exfiltration. It has never fired despite a known insider-threat incident last quarter where an employee exfiltrated 40 GB of customer data over three weeks.

ALERT IF user.daily_outbound_bytes > 5_000_000_000
WITHIN 24 HOURS

What structural flaw lets a 40 GB exfiltration over three weeks evade this rule?

The following controls all protect log integrity against a post-breach attacker with root on the logging host, EXCEPT:

During a breach response, the SOC performs the following actions. Which action is an example of eradication in the NIST SP 800-61 incident response lifecycle?