Why is centralized log management important for detection?
- A.To reduce disk usage, simplify backup schedules, and lower the overall storage budget each data center each fiscal quarter
- B.To satisfy a single compliance checklist item, and free the team from any further log review obligations afterward once the annual audit closes
- C.To improve system performance, reduce CPU load, and shorten the time needed for nightly batch processing jobs across the server farm
- D.To aggregate logs from multiple sources for correlation, analysis, and faster detection of security events
Why D is correct
Centralized logging enables correlation of events across multiple sources, providing holistic visibility needed to detect complex attacks spanning multiple systems.
Know someone studying for NIST CSF? Send them this one.