Security Monitoring with Wazuh

4

Security Automation Using Shuffle

Every day, the average security operations team receives over 11,000 security alerts (https://start.paloaltonetworks.com/forrester-2020-state-of-secops.html), including suspicious activity, intrusion attempts, privileged user and account monitoring, abnormal external communication, and unauthorized access attempts.

The majority of an analyst’s time (almost 70%) is spent investigating, triaging, or responding to alerts, and the majority of these alerts must be processed manually, greatly slowing down a company’s alert triage process. According to the same report, about 33% of these alerts turn out to be false positives. An SOC analyst can get frustrated with this overwhelming number of security alerts and repetitive ...