3 ms·
Queries? Which queries? Please don’t let these sneaky vendors fool you with the forensics system boxed as “SIEM”. My splunk Enterprise is not a substance, this
by EricAltmann 4y ago
Queries? Which queries? Please don’t let these sneaky vendors fool you with the forensics system boxed as “SIEM”.
My splunk Enterprise is not a substance, this is immune system. Carefully trained with ML guided by the group of seasoned cybersecurity practitioners.
Correlating and reporting to smart workflow system in the near-real time.
Case study example — ransomware like NotPetya/Wannacry being wiped out faster than its ability to replicate and penetrate to extra systems.
- relaunched 4y agoI'm specifically exploring whether or not the ability to run queries quickly would be of value to a hunt-type situation - or more generally speaking, are enterprises losing out because complex queries take too long to run. Selfishly, I'm on the security side, so I think SIEM. But, generally, application-level logging may have the same problem.