Match each cybersecurity monitoring technology or telemetry source to its primary function: Technologies: 1. EDR 2. SIEM 3. Full-packet capture 4. NetFlow Functions: - Records detailed host-level and process activity on endpoints - Ingests and correlates event logs from diverse enterprise sources - Captures and preserves complete network payloads and packet headers - Generates statistical metadata summaries of network sessions (e.g., source, destination, volume)

### The pairs | Item | Matches | Why | |---|---|---| | EDR | Records endpoint activity for investigation | Endpoint telemetry helps analysts examine device behavior. | | SIEM | Ingests and correlates logs from diverse sources | Correlation helps reveal relationships across an environment. | | Full-packet capture | Retains detailed network traffic contents | It provides detailed evidence but increases storage demands. | | NetFlow | Summarizes traffic origin, destination, and amount | Flow records describe communication without storing every packet's full content. | ### Remember Endpoint, aggregated logs, packet contents, and flow summaries are different evidence sources.