Break down security threats
3 tiers
- 1 - monitoring, initial triage, primary investigations
- 2 - digital forensics, detailed investigation, faster recovery
- 3 - proactive threat hunting
what about NOC ?
Process, People, Tool
SIEM Tool Splunk - SIEM Tool
EDR Tool Endpoint Detection and Response Tool Windows Defender for endpoint
Security Orchestration and Automation Tool SOAT Phishing analysis, Email Analysis
Incident Management Tool NIST and SANS