Kaspersky guide on matching SIEM correlation rules to the event sources a company actually has
RESEARCHKasperskyredteam/daily · 1 source
- Severity
- Info
- Sources
- 1
What happened
A security monitoring system only spots threats if it receives the right logs from the company's computers and network devices. A detection rule for a system the company does not use will never fire, so the article advises checking which data sources are connected before choosing rules.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Check which event sources are actually connected and feeding data into your SIEM.
- Confirm that audit policies capture the specific event types each enabled rule needs.
- Review your SIEM rule set and ATT&CK coverage after every notable infrastructure change.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Kaspersky Daily
Who and what is in it
Companies