Orion Cassetto

A security operations center continuously monitors and analyzes the security procedures of an organization. It also defends against security breaches and actively isolates and mitigates security risks. We look at key SOC roles and responsibilities and best practices.

Today, data is more available, transferable and sensitive than ever. The best way to stop data leaks is[…]

UEBA solutions use artificial intelligence and machine learning, advanced analytics, data enrichment, and data science to effectively combat advanced threats. A UEBA solution combines all the data sources for analysis and automatically synthesizes results so analysts get a lower volume but higher fidelity feed instead of drowning in alerts.

Security information and event management systems are now used by medium-sized and even small organizations. Open Source SIEMs are compelling for new adopters because of their low licensing cost and growing feature set. Which open source SIEMs are out there, and how do they compare to the traditional enterprise offerings?

Read about SIEM-as-a-Service and how Exabeam SaaS Cloud reduces SIEM deployment, maintenance, and operational overhead by delivering the Exabeam Security Management Platform as a cloud-based service. SaaS Cloud ingests and behaviorally analyzes data from any cloud or on-prem data source, empowering enterprises to detect, investigate, and respond to cyber attacks more efficiently.

Security Event and Information Management (SIEM) systems are at the core of mature security teams. Learn SIEM basics and what’s next for SIEM technology.

Learn about UBA technology, and its extension UEBA (User Entity Behavior Analytics), how it works, and which threats it uncovers that no other tool can see.

When I was preparing to write this blog, I spent time reviewing the 2018 Gartner Magic Quadrant for Security Information and Event Management report, then reviewed my analysis from the 2017 report. A few trends emerged. After reading this year’s report, my conclusions on the SIEM landscape are as follows:
– Threat management is paramount for growth
– Analytics is key
– SIEMs must be end-to-end

Threat intelligence is critical to modern cyber security. Learn about its 4 essential layers: sources, feeds, platforms, and professional services.

How to build an incident response plan around the SANS incident response process, examples to get you started, and a peak at incident response automation.

UEBA stands for User and Entity Behavior Analytics. We explain every word of the acronym and provide a 5-minute primer with everything you need to know about UEBA.

How will organizations spend their increased cybersecurity budgets? Most need to invest in new technology to achieve effective network security and incident response (IR). A cybersecurity technology that’s seeing significant growth, UEBA streamlines overall security operations while alleviating the ever-increasing pressures on teams that stem from chronic cybersecurity issues.