The core issue described is the failure to recognize a low-and-slow attack chain composed of individually low-fidelity events. Implementing correlation rules (Option C) in the SIEM or SOAR is the most effective solution. This allows the system to analyze multiple seemingly innocuous events in sequence, identify patterns indicative of an attack (e.g., reconnaissance followed by credential access on a critical asset), and then automatically elevate the aggregated incident's severity and priority.
Options A and B are inefficient or reactive.
Option D risks missing legitimate threats.
Option E would lead to significant alert fatigue and false positives, overwhelming analysts.

The Pathfinder data collector in Cortex XSIAM collects network metadata such as DNS queries, HTTP headers, and DHCP information.

User and Entity Behavior Analytics (UEBA) uses behavioral baselining across users and entities to detect anomalies indicative of insider threats or abuse of authorized access across multiple data sources, making it the most efficient for this purpose.

Cortex XDR benefits organizations that need to integrate data from network traffic, endpoints, cloud, and identity systems to detect and respond to threats holistically, unlike EDR which focuses primarily on endpoints.

RBAC in Cortex XDR enables management of feature access and permissions based on job function, ensuring users can only perform authorized actions.