Upon a suggestion from Mr. Hay, I took https://sigopt.com/ for a spin. I plugged it into our SIEM and Vulnerability models. I am astonished. Just when I thought every bit of value was squeezed from the systems, it is continuing to pull out indicators and APT actors like candy at a weight loss camp. One should give it a spin when they need to further optimize their models. For blackhats, this technique will become a significant pain as additional academic savy private sector practitioners move beyond log management and playbooks.
SIEM
When your SIEM models are not enough
Just when I thought every bit of value was squeezed from the systems, it is continuing to pull out indicators and APT actors like candy at a weight loss camp.
Key takeaways
- SIEM alert thresholds require continuous algorithmic optimization to minimize false positives.
- Hyperparameter tuning in security ML models balances precision against recall in threat detection.
- Static alert thresholds decay rapidly as normal baseline network traffic patterns shift.
About the author
Explore cutting-edge cybersecurity insights and protective strategies with John Menerick. Deep dives, threat analysis, and live streams from securesql.info.
