According to the CRISC Review Manual1, data selection is the process of choosing the appropriate data sources and variables for data analysis. Data selection is the most critical step in data analytics, as it determines the quality and validity of the results and insights derived from the analysis. Incorrect data selection is the greatest risk associated with the use of data analytics, as it can lead to inaccurate, incomplete, irrelevant, or biased outcomes that can adversely affect the decision making and performance of the organization. Incorrect data selection can also cause legal, regulatory, ethical, or reputational issues for the organization, if the data used for analysis is not authorized, reliable, or compliant. References = CRISC Review Manual1, page 255.

A compensating control addresses risk when the primary control cannot meet the required objectives due to practical constraints.
Reference:CRISC Manual - Domain 3, Slide 345

The 3-minute threshold is a KRI designed to act as an early warning before a more critical limit (5 minutes) is breached, helping prevent risk realization.
Reference:CRISC Manual - Domain 4, Slide 380-382

Understanding the Question:
The question asks which tool is best for aggregating data from multiple systems to identify abnormal behavior.
Analyzing the Options:
A: Cyber threat intelligence:Provides information on potential threats but does not aggregate data from multiple systems for behavior analysis.
B: Anti-malware software:Focuses on detecting and removing malware, not aggregating data from multiple sources.
C: Endpoint detection and response (EDR):Monitors endpoints for suspicious activity but is more limited in scope compared to SIEM systems.
D: SIEM systems:Security Information and Event Management systems collect, aggregate, and analyze data from various sources to identify and respond to abnormal behavior.
SIEM Systems:SIEM systems are designed to aggregate and analyze security data from multiple sources such as network devices, servers, and applications. They provide real-time analysis of security alerts generated by hardware and software.
Functionality:SIEM systems use advanced analytics to correlate data from different sources and detect patterns that indicate abnormal behavior. This makes them highly effective in identifying and responding to security incidents.
References:
CRISC Review Manual, Chapter 3: Risk Response and Reporting, mentions the importance of centralized monitoring systems like SIEM for effective risk management.

Before selecting technologies or deployment models, a risk assessment should be conducted to evaluate potential threats, vulnerabilities, and controls. This ensures the technology aligns with the risk appetite and regulatory requirements of the organization.
Reference:CRISC Manual - Domain 2, Slide 178-180, 250