Timeline for How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 27, 2018 at 6:14 | comment | added | schroeder♦ | Ok, then I have already provided that example | |
| Sep 27, 2018 at 5:52 | comment | added | Sun-IT | Alert correlation is a type of long analysis. It focuses on the process of clustering alerts (events), generated by NIDS and HIDS computer systems, to form higher-level pieces of information. taken from wikipedia Example of simple alert correlation is grouping invalid login attempts to report single incident like "10000 invalid login attempts on host X". | |
| Sep 24, 2018 at 6:54 | comment | added | schroeder♦ | I'm not sure what you mean. What is "alert correlation"? I already provided an example for what I think "alert correlation" is. | |
| Sep 24, 2018 at 4:20 | comment | added | Sun-IT | ohh, that make sense. thanks a lot. and another thing, how alert correlation is calculated? i have gone through various website to understand alert correlation but no research paper or website gives idea about how alert correlation is calculated. | |
| Sep 24, 2018 at 4:16 | vote | accept | Sun-IT | ||
| Sep 23, 2018 at 12:15 | history | answered | schroeder♦ | CC BY-SA 4.0 |