Weak signals can correlate into a strong case
No single event was worth an alert. Together they describe an intrusion.
A login at an unusual hour, a new administrative tool appearing, a burst of outbound traffic. Individually each is noise and would generate false positives constantly on its own. Correlated across time and entity they become a case worth investigating. It is the main argument for centralising events rather than alerting on each source separately.
More on Detection engineering
- A detection is a hypothesis encoded as logicA guess you can run
- High fidelity and high coverage pull in different directionsOne screen, one setting
- Detections inherit telemetry blind spotsThe hole is copied too
- Detection names should describe behaviour, not certaintyName the behaviour
- Suppression is a security decisionThe tag on the switch
- Detection rules need regression testsRun the old cases again