150 Points
1 Year
Top 5

User Activity

10 months ago
You can not process and generate advanced correlated alerts without aggregation: limiting your correlation to one set of source will let your SIEM blind and unaware of global context. So yes, to get an 'EFFECTIVE' event monitoring with the goal to correlate them, you need…
12 months ago
Yes I would recommend to evaluate it side by side with others, as the admin to establish correlation rules and configuration is a bit less intuitive than some competitors, but the SOC analyst interface IS very intuitive, and it’s where you will spend most of your time…