Integrating threat intelligence into SIEM tools – Reactive and proactive defense through SIEM tools
In an organization with no CTI program, a SIEM tool collects system logs and internal documentation from all devices (servers, wireless access points, firewalls, IDSs, and IPSs), applications (for example, software applications and protocol applications), and endpoints (for example, PCs, printers, and mobile devices) that connect to the network. It collects data from different system environments and different formats. It then consolidates, correlates, and converts that data to human-readable formats. Systems and people can query the processed data to identify abnormal activities. The SIEM system generates alerts (alarms) that indicate possible threats or attacks. All system events and flows must be logged to ensure proper internal visibility. A SIEM system can help with reactive and proactive system defense depending on the detected activity. A reactive defense is the system...
