Security Intelligence with Sumo Logic

10

The Insight Engine

So far in our discussions, we've covered a lot of the problem areas that security teams face—lack of visibility and context and too much noise. In a modern environment, there are a lot of accounts, APIs, endpoints, and identities to keep an eye on. In the previous chapter, we looked at why a solid data foundation is imperative to creating an environment where your data can be processed and normalized to give you a single environment in which you have as few blind spots as possible. The cherry on top of this cake is the Insight Engine.

Across the security industry, vendors use different terms to describe the same core concept. Alert, detection, correlation event, rule fire, and signal are often used interchangeably. In Sumo ...