An analyst reviews evidence to determine whether an alert is a true incident. Which function is being performed?

A centralized team monitors, investigates, and responds to security activity. Which term fits?...

A SOC first recognizes suspicious behavior from telemetry and alerts. Which function is being perfor...

A team contains a compromised endpoint and blocks malicious traffic. Which function is being perform...

A phishing alert triggers a playbook that enriches indicators, notifies users, and creates a ticket....

Analysts need to correlate firewall, endpoint, and cloud logs to find related suspicious activity. W...