Hi everyone,
I am looking for SIEM use cases and triggers.
On this thread https://www.peerspot.com/questions/what-are-the-top-use-cases-to-implement-after-deploying-a-siem, @David Swift said he has written SANS papers. I have looked for them (in white papers and gold papers) and cannot find them. Would anybody be able to help please? I found two papers on the wikipedia page, maybe there is more?
Other helpful resources would be good too, if any. Do you know other papers/documents listing SIEM use cases and triggers please?
Thank you for your help.
Kind Regards,
Bertrand
You may also want to consider the MITRE ATT&CK framework.
https://attack.mitre.org/
Best Practice Papers
Additional detail is available in several public papers vetted by SANS that have become industry best practices.
A Process for Continuous Security Improvement Using Log Analysis
https://www.sans.org/white-pap...
#33824
Successful SIEM and Log Management Strategies for Audit and Compliance
https://www.sans.org/white-pap...
#33528
A Compliance Primer for IT Professionals
https://www.sans.org/white-pap...
#33538
A Practical Application for SIM/SEM/SIEM Automating Threat Identification
https://www.sans.org/white-pap...
#1781
@David Swift thank you
https://www.siemusecases.com is the probably the best starting point.
David has answered my question. Thank you!
Hi @David Swift and @Chiheb Chebbi, possibly you can help @Bertrand in answering their question.
Thanks!