A suspected insider is exfiltrating data from within your or…
A suspected insider is exfiltrating data from within your organization. You’re asked to use firewall logs and IDS alerts to investigate. How would you correlate firewall and IDS data? Suggest a preventive measure to catch insider threats in real time.