I. Identify one of the core needs of threat intelligence is the ability for the SIEM system to analyze event data to detect anomalies or track interactions between users and places where data is stored.
II. Recognize that some SIEM systems can initiate predefined defensive scripts to automatically disrupt ongoing cyberattacks.