A penetration tester was able to connect to a company's internal network and perform scans and staged attacks for the duration of the testing period without being noticed. The SIEM did not alert the security team to the presence of the penetration tester's devices on the network Which of the following would provide the security team with notification in a timely manner? a. Implement rogue system detection and sensors.
b. Create a trigger on the IPS and alert the security team when unsuccessful logins occur.
c. Decrease the correlation threshold for alerts on the SIEM
d. Run a credentialed vulnerability scan.