Next-Gen SOC | Episode 3: Correlation, Machine Learning, and Threat Hunting скачать в хорошем качестве

Next-Gen SOC | Episode 3: Correlation, Machine Learning, and Threat Hunting

Originally posted on November 18, 2019 Security Information and Event Management (SIEM) isn't a new technology, but it still plays a critical role in the modern SOC as a last line of defense against threats, as a SIEM with real-time correlation provides the fastest method for detecting threats following known attack patterns. Some attacks may still slip "under the radar" though, which is why tools that leverage machine-learning, like User and Entity Behavior Analytics (UEBA), are an important support to your SIEM as they will detect more unusual threats as well as greatly increase the overall fidelity of your security alerts. SIEM and UEBA are further supported by threat hunting tools that enable your hunt teams to track down any other threats that may still be lurking in your system. All three approaches are important to your threat detection and response ecosystem.