Which three of the following best describe how a SIEM should be used? (Choose three.)