Firewall network traffic logs are the largest driver of Microsoft Sentinel ingestion costs. Yet they remain a critical source of information for threat detection, investigations & incident response. Explore how Sentinel Summary Rules can reduce the cost of ingesting firewall traffic events while retaining the visibility SecOp teams need to detect threats & investigate incidents.
This blog is the first in a series exploring how Summary Rules, together with Auxiliary or Data Lake storage, can help organizations optimize SIEM costs without compromising core threat detection and monitoring capabilities.
Introduction With the never-ending amount of data we generate, process, and share within and between companies, and the value this information can hold – such as personal data, top secret documents, or even information related to national security – it is natural that one of the main interests in cybersecurity is data security. Let it … Continue reading Staying on top of your data with Microsoft Purview
Recently, for our open-sourced ee-outliers framework, we released a new outlier model capable of detecting the sudden appearance of one or multiple field values of an Elasticsearch event. For example, this model could spot new TLDs that are suddenly being contacted (DNS/SSL) and communicating with C2 domains. It could also detect an executable that suddenly … Continue reading Detecting the sudden appearance of events with ee-outliers and Elasticsearch
In our previous blogpost, we discussed how to take some of the dust off your Acceptable Use Policy (AUP) or IT security code of conduct, making it a bit more user friendly and educational. Now, we're giving you a sort of checklist of the topics to discuss in a typical AUP, based on the table … Continue reading A checklist to populate your Acceptable Use Policy
