Match each incident detection contributor to its primary contribution: Contributors: 1. Automated detection tool 2. End user 3. Security analyst Contributions: A. Reports suspicious emails or unexpected requests encountered during regular workflow B. Generates alerts automatically by evaluating events against configured rules or baselines C. Investigates alert context to differentiate benign operational anomalies from genuine threats

### The pairs | Item | Matches | Why | |---|---|---| | Automated detection tool | Flags activity according to configured capabilities or analysis. | A tool applies its detection functions to activity and can alert the organization to a possible event. | | End user | Reports phishing or suspicious activity noticed during ordinary work. | Users can observe suspicious messages or actions that a technical system may not identify. | | Security analyst | Interprets alerts and distinguishes normal variation from threats. | Analysts examine context and correlations to decide what an alert means. | ### Terms - **Alert**: A notification that activity may need review. - **Normal variation**: Expected differences in activity that do not necessarily indicate a threat. ### Remember Tools flag, users notice, and analysts interpret.