Abstract
As we discussed in the preceding chapter, we are no longer considering the data being processed by the Enterprise Security Management (ESM) system as being a simple log. The logs have been enriched by the connectors or log collection appliances to the point where they are now considered events. When the ESM system receives these events a series of real-time operations are applied in memory. In this way, ESM solutions help identify and manage malicious activity more efficiently than having to rely upon a database for historical queries. Some examples of this are real-time event prioritization, correlation, and visual analytics. This chapter will focus on the ESM system's capability to process these events in real time and some of the tools that analysts can use to assist in investigations and incident response in the form of workflow and network remediation. The next chapter will cover event analysis from a forensics and reporting perspective by using historical data from the ESM system's database.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
More From: Physical and Logical Security Convergence: Powered By Enterprise Security Management
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.