Which system is described as creating log files that can be used to detect breaches?

Which system is described as creating log files that can be used to detect breaches?

• A. Intrusion detection systems
• B. Antivirus software
• C. Firewall
• D. Security Information and Event Management

Answer: (A)

An Intrusion Detection System is designed to monitor network and host activity for signs of unauthorized access and to generate log entries and alerts when suspicious behavior is detected. Those log files and alerts become the primary means detectives use to spot breaches, investigate incidents, and respond quickly. This focus on continuous monitoring and reporting of potential intrusions makes it the best fit for a system described as creating log files that can be used to detect breaches. Antivirus software logs malware detections on individual hosts, which is useful for endpoint protection but not the primary mechanism for network-wide breach detection through log analysis. A firewall logs traffic and enforces access controls, helping to block or flag suspicious traffic, but its main role is enforcement rather than generating breach-detection logs across an environment. Security Information and Event Management, on the other hand, centralizes and analyzes logs from many sources to detect breaches, but it does not primarily create the individual log files itself; it aggregates and correlates them for detection and response.

An Intrusion Detection System is designed to monitor network and host activity for signs of unauthorized access and to generate log entries and alerts when suspicious behavior is detected. Those log files and alerts become the primary means detectives use to spot breaches, investigate incidents, and respond quickly. This focus on continuous monitoring and reporting of potential intrusions makes it the best fit for a system described as creating log files that can be used to detect breaches.

Antivirus software logs malware detections on individual hosts, which is useful for endpoint protection but not the primary mechanism for network-wide breach detection through log analysis. A firewall logs traffic and enforces access controls, helping to block or flag suspicious traffic, but its main role is enforcement rather than generating breach-detection logs across an environment. Security Information and Event Management, on the other hand, centralizes and analyzes logs from many sources to detect breaches, but it does not primarily create the individual log files itself; it aggregates and correlates them for detection and response.