A cybersecurity analyst is tasked with investigating a series of network anomalies.

This question aligns with CHFI v11 objectives underProcedures and Methodology, specificallyevent correlation and analysis techniquesused to investigate complex incidents. Event correlation is essential for transforming large volumes of logs and alerts into meaningful incident narratives. CHFI v11 describes multiple correlation approaches, each suited to different investigative needs.

Thegraph-based approachmodels systems, applications, users, and network components asnodes, while relationships such as dependencies, communications, or trust relationships are represented asedges. By constructing such graphs, investigators can visualize how events propagate across interconnected systems, identify attack paths, and determine how a compromise in one component impacts others. This approach is particularly effective in analyzing lateral movement, dependency-based failures, and multi-stage attacks in enterprise environments.

Rule-based approaches rely on predefined conditions, codebook-based approaches match patterns against known attack templates, and neural network-based approaches focus on anomaly detection using machine learning. While these are valuable, only the graph-based approach explicitly represents system dependencies and relationships in a node–edge structure. Therefore, consistent with CHFI v11 event correlation methodologies, the correct answer isGraph-Based Approach.