Who Validates Alerts Validated by Your Alert Validator Software?

Pardon the idiotic title, but some recent discussions around security analytics have made this question practically relevant.

So:

1. You have a SIEM and other security technologies focused on detection and alerting
2. As a result, you have lots of security alerts – and you think it is too damn many!
3. You don’t have enough people to tune the systems that produced the alerts so that they produce fewer/better alerts
4. Also, you do not have enough skilled SIEM people to triage / validate the alerts
5. Instead, you want to buy a new, “magic bullet” tool that promises to “make better alerts”
6. Your security budget: $$$$$. Budget after the magic tool purchase: $$
7. The magic tool is deployed and – abracadabra! – your 23,543 alerts become 17 alerts
8. What just happened? Where did they go?!
9. Now you need skilled people to a) confirm that alerts that remained really do matter, b) that these alerts matter the most to you and also to c) confirm that alerts that vanished don’t matter
10. If a), b) and c) are not to your perfect satisfaction, you now need skilled people to tune the new tool.
11. Result? You bought a new tool to avoid hiring people, and now you need to hire people to run this tool. In fact, you needed, 3 security analysts @ $80K/year, and now you need a security data scientist @ $240K/year …
12. Explain :–)

On a more serious note, we make a lot of exciting predictions on the rise of smart machines, but for the foreseeable future said machines will require smart people to run them …

Blog posts on the security analytics topic:

• Killed by AI Much? A Rise of Non-deterministic Security!
• SIEM / DLP Add-on Brain
• Those Pesky Users: How To Catch Bad Usage of Good Accounts
• Security Analytics Lessons Learned — and Ignored!
• Security Analytics: Projects vs Boxes (Build vs Buy)?
• Do You Want “Security Analytics” Or Do You Just Hate Your SIEM?
• Security Analytics – Finally Emerging For Real?
• Why No Security Analytics Market?
• SIEM Real-time and Historical Analytics Collide?
• SIEM Analytics Histories and Lessons
• Big Data for Security Realities – Case 4: Big But Narrowly Used Data
• Big Data Analytics Mindset – What Is It?
• Big Data Analytics for Security: Having a Goal + Exploring
• More On Big Data Security Analytics Readiness
• Broadening Big Data Definition Leads to Security Idiotics!
• 9 Reasons Why Building A Big Data Security Analytics Tool Is Like Building a Flying Car
• “Big Analytics” for Security: A Harbinger or An Outlier?