Anti-patterns in Security Monitoring
summary
Collecting everything without a plan wastes budget and generates noise: one org ingests the same log source three times and pays $100k/month extra while the platform spits out 15–600 alerts daily, far more than one analyst can handle (roughly five useful cases). Template detections and unvetted threat feeds cause false positives and poisoned intel, cloud log volume drives cost, and overreliance on network or shiny AI tools fails unless data has a clear detection or compliance purpose and people and processes come first.
AI-written summary · about
chapters (11)
- 0:00Security monitoring basics
- 1:28How monitoring systems work
- 3:53Security monitoring challenges
- 5:59Security anti-patterns
- 7:02Data collection risks
- 8:26Template detections waste
- 9:32Over-reliance on network security
- 10:57Identity vs network security
- 11:40Chasing new security tools
- 12:42Tool consolidation
- 14:09Key takeaways
related talks
46mLearning security monitoring through failure
31mCollection is not Detection - Sec Ops in a Cloud Native Environment
01h 15mMonitoring: Turning Noise into Signal
28mPatterns for scalable security detections on AWS
39mAnti-Patterns: How to Not implement a Cloud Security tool
53mSecurity Operations 2018: What Is Working? What Is Not.
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
27mCollect All the Data; Protect All the Things