Detection

Design Actionable Security Alerts

Collecting security logs does not guarantee that anyone will notice an attack or dangerous failure. A system can record every authentication failure and privilege change yet still leave responders searching through millions of events after the damage is done. A security alert is a signal that selected activity may require investigation or action. The difficult part is not generating alerts. It is generating alerts that are timely, understandable, and reliable enough that responders know what to do next.