December 2017
Intermediate to advanced
410 pages
11h 5m
English
Security Incident and Event Management (SIEM) enhances the power of a traditional log monitoring tool with the help of co-relation and alerting-based solution.
Co-relation is one powerful feature that makes SIEM a distinguished player.
Let's understand the co-relation part with an example. The user's ID card has been swiped in at the office; however, his ID card was swiped at the datacenter provider as well without having swiped out at the office. This seems suspicious. SIEM will co-relate the two events and can determine that the user cannot be present at both the locations simultaneously and will alert the SOC immediately.
There was a possible port scan from a particular IP address and then there was ...
Read now
Unlock full access