And I’m talking real smoking guns, not crappy anomaly alerts. From my experience, the most effective use cases for threat detection are those which simply: Provide a list of detections which have a high confidence of threat Look for validations which follow the detection. So: Here’s an example for logic that would provide good use … Continue reading SIEM Use Case Guide – Part 2