2014年7月20日
Understanding and Selecting a SIEM/LM: Correlation and Alerting
摘要： Continuing our discussion of core SIEM and Log Management technology, we now move into event correlation. This capability was the holy grail that drov... 阅读全文
posted @ 2014-07-20 22:27 规格严格-功夫到家 阅读(265) 评论(0) 推荐(0)
SIEM
摘要： Centralize events - if everything is in one place it's much easier to search for something.Normalize events - if the format of the events is the same ... 阅读全文
posted @ 2014-07-20 10:58 规格严格-功夫到家 阅读(304) 评论(0) 推荐(0)
Correlation rule tuning
摘要： Lots of organizations are deploying SIEM systems either to do their due diligence or because it’s part of a regulatory requirement. One of the misconc... 阅读全文
posted @ 2014-07-20 10:55 规格严格-功夫到家 阅读(260) 评论(0) 推荐(0)