You observe multiple distinct, low-severity suspicious activities on a single internal server; no single event is a high-confidence IOC. You want ongoing heightened scrutiny. What should you do?

• A. Schedule a daily SecOps report detailing all activity on this server.
• B. Develop a server-specific YARA-L detection rule.
• C. Add the server to a SecOps watchlist, and monitor closely.
• D. Create a case, isolate the server, and escalate for forensics.

Answer: (C)

When you have multiple low-severity suspicious activities on a single internal server and no single event stands out as a strong IOC, the priority is to increase visibility without disrupting operations. Adding the server to a SecOps watchlist and monitoring it closely lets you track related activity, correlate events over time, and escalate if patterns or thresholds emerge. This approach provides focused oversight while preserving service availability, and it can scale as more data comes in. The other options either generate excessive noise (a daily report of all activity), rely on a specific detection rule that may not exist yet, or are too disruptive too soon (isolation and forensics) given the low-severity signals.