In incident response, which log would contain entries about security software alerts and policy violations on endpoints?

• A. OS logs
• B. Audit logs
• C. Security software logs
• D. Application logs

Answer: (C)

Security software logs on endpoints are the primary source for entries about alerts and policy violations. These logs come from antivirus, EDR, and other protection tools and capture detections, blocks, quarantines, and policy enforcement actions. They provide the most direct view of what the security tools flagged or prevented on the device, which is essential for understanding the threat and the response. Operating system logs document a broad range of system events but aren’t focused on security detections from protective software. Audit logs track user actions and compliance-related events, not the ongoing security alerts from protection tools. Application logs record events from individual applications and don’t reflect centralized security enforcement across the endpoint. Therefore, the most relevant source for security alerts and policy violations is the security software logs.