Articles in SIEM

SIEM – Incident Prioritization

Not all alerts present the same level of risk. An unusual connection on a […]

SIEM – The problem of alert overload

One of the main risks associated with deploying a SIEM is the volume of alerts. A poorly managed SIEM […]

The SIEM and the SOC

The SIEM is often considered one of the central components of a Security Operations Center — […]

The SIEM and MITRE ATT&CK

MITRE ATT&CK is now a key reference for structuring detection capabilities. The framework describes […]

SIEM and malware-free attack detection

A common mistake is to assume that a cyberattack necessarily involves a malicious file. This is not the case […]

SIEM – Detection of Abnormal Behavior

A SIEM can highlight different types of anomalies. For example: The goal is not simply […]

A SIEM transforms events into context

Modern cybersecurity is no longer simply about asking, “What happened?” It requires […]

Correlation: the core value of a SIEM

Correlation involves relating several events. Let's take a simple example. A SIEM receives […]

SIEM – Why centralize logs?

Imagine an attack against a company. At 2:14 AM, an administrator account logs in from an address […]

SIEM – The real problem: logs are everywhere

A modern company may possess hundreds, or even thousands, of security data sources. […]