What step in the process of Intrusion Detection as shown in the exhibit would determine if given ale

What step in the process of Intrusion Detection as shown in the exhibit would determine if given alerts were part of a bigger intrusion, or would help discover infrequent attacks?

A.
5

B.
9

C.
12

D.
10

E.
4