Kaspersky guide on matching SIEM correlation rules to the event sources a company actually has
RESEARCHKasperskyredteam/daily · 1 source
- Severity
- Info
- Sources
- 1
What happened
The article argues that a SIEM's rule count and MITRE ATT&CK coverage percentage are misleading on their own, because a rule only works if its required event sources and event types are being collected. It recommends mapping connected sources first, verifying audit policies capture the needed events, and rechecking after infrastructure changes. Kaspersky describes a knowledge base in its SIEM with a rule library, a builder that selects rules by source, and an ATT&CK matrix view.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check which event sources are actually connected and feeding data into your SIEM.
- Confirm that audit policies capture the specific event types each enabled rule needs.
- Review your SIEM rule set and ATT&CK coverage after every notable infrastructure change.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Kaspersky Daily
Who and what is in it
Companies