View all questions & answers for the PSE-Cortex exam
What is a benefit of user entity behavior analytics (UEBA) over security information and event management (SIEM)?
SIEMs supports only agentless scanning, not agent-based workload protection across VMs, containers/Kubernetes.
UEBA can add trusted signers of Windows or Mac processes to a whitelist in the Endpoint Security Manager (ESM) Console.
SIEMs have difficulty detecting unknown or advanced security threats that do not involve malware, such as credential theft.
UEBA establishes a secure connection in which endpoints can be routed, and it collects and forwards logs and files for analysis.
Submit