> What you're looking for is a system that will automatically analyze logs and/or traffic for malicious events and alert on them. (I don't pick on you, so I ho

> What you're looking for is a system that will automatically analyze logs and/or traffic for malicious events and alert on them. (I don't pick on you, so I hope this comment doesn't come off that way.) What are "malicious events" and how will you know them when you see them? I would argue that, instead, your system should automatically analyse logs for benign (a.k.a., completely normal, expected, innocent) events, toss them out, and leave humans to review anything that's left over. With any new "system", it will take a bit to build up a complete "whitelist" so that the amount of data to review is down to a manageable level but you'll be rewarded with much more meaningful and actionable data when you get there.