A Security Engineer Is Investigating a Compromise That Occurred Between

Multiple Choice

A security engineer is investigating a compromise that occurred between two internal computers. The engineer has determined during the investigation that one computer infected another. While reviewing the IDS logs, the engineer can view the outbound callback traffic, but sees no traffic between the two computers. Which of the following would BEST address the IDS visibility gap?

A) Install network taps at the edge of the network.
B) Send syslog from the IDS into the SIEM.
C) Install HIDS on each computer.
D) SPAN traffic form the network core into the IDS.