EP125 Will SIEM Ever Die: SIEM Lessons from the Past for the Future
Cloud Security Podcast by Google
00:00
How to Fix a Login Failure
One event means nothing. Everything is always an early indicator. I see there are connoisseants events when somebody's hitting my firewall and finally finds a port that's open. So repeat firewall drops are useful, but only one out of a thousand events, the triggers. Anton: "I can tell you from measured results puts me down about a 3% false positive"
Play episode from 06:23
Transcript
