Refer to the exhibits. You are troubleshooting why the rule shown in the exhibit is generating incidents for successful Remote Desktop Protocol (RDP) connections with correct logins. It should only be triggering when a person fails a login three or more times to the target device when connecting with RDP. What is causing the rule to be triggered by correct login events? (Choose one answer)

• A. The subpattern relationship `RDP_Connection:User = Failed_Logon:User` never matches.
• B. The Boolean between the subpatterns is incorrect.
• C. The attribute types in the subpatterns do not match.
• D. The RDP login is different from the login used to access the target device.

Correct Answer: C

Brave-Dump Clients Votes