Badges

120 Points
4 Years
Top 20

User Activity

About 1 year ago
Almost 4 years ago
You can not process and generate advanced correlated alerts without aggregation: limiting your correlation to one set of source will let your SIEM blind and unaware of global context So yes, to get an 'EFFECTIVE' event monitoring with the goal to correlate them, you need to…
Almost 4 years ago
Yes I would recommend to evaluate it side by side with others as the admin to establish correlation rules and configuration is a bit less intuitive than some competitors, but the SOC analyst interface IS very intuitive, and it’s where you will spend most of your time once…