Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?
This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too. Rich posted these follow-up tweets: And by APT I mean real ...
You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...