A SOC manager wants to know when to trigger a full retraining of their ML-based threat detection model. Which operational metric most directly signals that retraining is needed?

• A.The SIEM rule set has been updated, requiring the ML model to be retrained to stay synchronized
• B.The model has been running in production for more than 6 months, since all models should be retrained on a fixed calendar schedule
• C.The number of new CVEs published exceeds 100 in a given month
• D.A sustained increase in the model's false negative rate (missed detections confirmed retrospectively) or a significant shift in the input feature distribution (data drift), compared to the model's deployment-time baseline