Where may an organization store EDR telemetry?

### Why this is right Organizations may store EDR telemetry in a dedicated database or aggregate it with other security data in a correlation platform such as a Security Information and Event Management (SIEM) system. ### The concept Storing telemetry makes it available for review and analysis when needed. A dedicated database keeps endpoint records in one place, while a correlation platform can combine them with logs and data from other sources. The material presents both as possible approaches. ### The other options - **B. Only in a firewall's rule list.** A firewall rule list is not described as an EDR telemetry store. - **C. Only in the endpoint's current memory, with no later review.** EDR retains records for review and analysis rather than limiting them to transient memory. - **D. Only in a DLP ruleset.** A DLP ruleset concerns data-handling policies, not EDR telemetry storage. ### Terms - **Security Information and Event Management (SIEM)**: A platform that collects and correlates security logs and data. - **Correlation platform**: A system that combines information to examine relationships across sources. ### Remember EDR telemetry can stand alone in a database or join broader security data in a correlation platform.