One of the primary responsibilities of a Security Operation Center (SOC) is to effectively manage issues related to monitoring the security perimeter. This involves the meticulous analysis of alerts, the creation of subsequent cases, and if necessary, the escalation of incidents to the client through ticketing systems or, in some cases, the closure of incidents…
Read MoreToday I’d like to tell you about the possibility of alerting when anomalies in network traffic are encountered. I use ntopng to generate, evaluate and forward these alerts. If you don’t know about ntopng, let me briefly describe for you what it does. According to its creator, ntopng is a High-Speed Web-based Traffic Analysis and…
Read MoreIn my previous post I showed you how to make your own alerts on NetEye SIEM by using the Elastic Watcher and Alerts and Actions features. But if we work in production environments, what we really need is an alert that can go directly to NetEye’s Monitoring Overview. How can we manage SIEM alerts and…
Read MoreThe main goal of a monitoring system like NetEye is to alert and notify you when something noteworthy happens in your environment. All the logs coming in to NetEye SIEM can be analyzed, and could raise one or more alerts in the Elastic Stack, such as detection, machine learning anomalies, etc. How can you make…
Read MoreTwo screens for monitoring, ticketing, event management, CRM, project management and Outlook, and at least another two screens for all the applications that you need to manage… that often seems to be the minimum for working efficiently. However, you probably don’t want your office to look like a NASA flight control room… To organize the…
Read More