#correlation

Log Analysis for Incident Response — SIEM Correlation and Pivot to Respond to Attacks

You just received a SIEM alert: an internal host is contacting an unknown IP on a non-standard port. Where do you start?...