Which team member or function is described as correlating logs and events, generating alerts, and conducting threat hunting?

### Why this is right The material assigns log and event correlation, alert generation, and threat hunting to managed security service providers. These activities help identify suspicious patterns and potential threats. ### The concept The response function can combine internal security, managed security, and forensic services. Internal staff include the Chief Information Security Officer (CISO), security engineers, and analysts. Managed providers monitor and identify patterns, while forensic specialists review logs, perform computer forensics, and investigate compromised systems. ### The other options - **B. Forensic specialists**: They review logs and investigate compromised systems, but the listed alerting and threat-hunting tasks are assigned to managed providers. - **C. The organization’s mission statement**: It expresses purpose and priorities; it does not perform operational monitoring. - **D. The security desk or information technology help desk**: These desks escalate issues to the program owner; the listed monitoring tasks belong to managed providers. ### Terms - **Threat hunting**: Searching for signs of threats rather than relying only on incoming alerts. - **Forensics**: Examination of evidence from systems to investigate activity. - **CISO**: Chief Information Security Officer, a senior organizational cybersecurity role. ### Remember Managed providers correlate and alert; forensic specialists investigate evidence.