CSA-CO March Meeting

Presenter: Keith Buswell
Presentation Title: Behavioral Analytics. Demand more from your SIEM
Presentation Focus: Applying Machine Learning tools on your SIEM for increased visibility.

Long have we looked at SIEM providers and asked for how many out of the box rules it has, or how many compliance reports they contain. At the end of the deployment, will I be doing best practices? It is time to evolve the market and start demanding more from your SIEM. Using out of the box Static Correlation rules are only as good as the content you continually develop to stay ahead of the game.

Applying Machine Learning tools can greatly increase your visibility into your environment by applying models to every User and Asset in your environment to let you know when things are not acting as normal. This in combination with Fact Based Rules provide a much more comprehensive approach than Static Rules alone.