Artificial Intelligence for Cybersecurity

8

User and Entity Behavior Analysis

Traditional enterprise cybersecurity relies on a Security Information and Event Management (SIEM) system to gather data needed for detecting and triaging security-related incidents. Based on this data, security experts create rules using their knowledge of known attacker tactics and techniques. They create a playbook where those rules are stored and a series of steps are defined on what actions are performed when data is found that matches those rules. This type of defensive system can detect a majority of threats that traditionally affect IT systems. However, especially in recent years, this kind of defense is becoming insufficient, as the attacks are getting more sophisticated and the threat actors find ...