Security Operations Center - SIEM Use Cases and Cyber Threat Intelligence

Book excerpt: Security analytics can be defined as the process of continuously monitoring and analyzing all the activities in your enterprise network to ensure the minimal number of occurrences of security breaches. Security Analyst is the individual that is qualified to perform the functions necessary to accomplish the security monitoring goals of the organization. This book is intended to improve the ability of a security analyst to perform their day to day work functions in a more professional manner. Deeper knowledge of tools, processes and technology is needed for this. A firm understanding of all the domains of this book is going to be vital in achieving the desired skill set to become a professional security analyst. The attempt of this book is to address the problems associated with the content development (use cases and correlation rules) of SIEM deployments.The term "Cyber Threat Intelligence" has gained considerable interest in the Information Security community over the past few years. The main purpose of implementing a Cyber threat intelligence(CTI) program is to prepare businesses to gain awareness of cyber threats and implement adequate defenses before disaster strikes. Threat Intelligence is the knowledge that helps Enterprises make informed decisions about defending against current and future security threats. This book is a complete practical guide to understanding, planning and building an effective Cyber Threat Intelligence program within an organization. This book is a must read for any Security or IT professional with mid to advanced level of skills. The book provides insights that can be leveraged on in conversations with your management and decision makers to get your organization on the path to building an effective CTI program.