While investigating alerts you notice a user entity has triggered a historical alert for Large Internal Data

Download. While investigating the alert, you notice that the download came from a different device than normalfor the user. Based on these conditions, is this a possible cause? (This is a classic user account take overpattern.)

You were called into a customer site to do an evaluation of installing IntroSpect for a small business. During

the discovery process, the customer asks you to explain when they would need to deploy a Packet Processor.

Does this explain the function of the Packet Processor? (They always need the Packet Processor to process

AMON data from the Aruba Networks Mobility Controller.)

You are visiting a site configured with IntroSpect, and the on-site admin tells you that they do not think that oneof their database servers has fired any alerts for large download or strange access patterns. Could this be areason? (The database server needs to be listed under Configuration>Analytics>User Correlation Config.)