The Analytics Enabled SOC Best Practices for Improving Incident Response
summary
Covers how SIEM is evolving toward analytics-driven capabilities, specifically using enterprise-wide data and dynamic analytics (as provided by vendors like Splunk) to equip SOC and global threat teams. Describes using those analytics to detect and respond to known and unknown threats, APTs, insider threat and fraud, and outlines best practices for improving incident response.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:58Challenges
- 2:57Mature Threat Landscape
- 4:40Tools
- 5:58New Approach
- 7:39Threat Landscape
- 9:09Third Party
- 11:24Technology
- 13:45Security Intelligence
- 14:29Key Elements
- 16:26Quixote Analysis
- 17:31Human Expertise
related talks
20mSIEM There, Done That: Rising Up in the SecOps Revolution
24mDetection & Response: Building Effective SOC Operations
21mBusiness Defence -- Managing the Insider Threat with Security Analytics
51mThe No BS SOC Story
54mSOCcing: Responding to a Cyber Incident
40mHow to Ruin your SOC in 5 Easy Steps
32mThe SOC Of The Future… The Future Is Now
17mIncident Response @ Scale-Building a Next Generation SOC