Gartner Blog Network

Category: 'threat-detection' Blog Posts

from the Gartner Blog Network

Endpoint Has Won, Why Bother With NTA?

by Augusto Barros  |  October 3, 2018

One of my favorite blog posts from Anton is the one about the "SOC nuclear triad". As he describes, SOCs should use logs, endpoint and network data on their threat...

Read more »

The "How To Build a SOC" Paper Update is OUT!

by Augusto Barros  |  September 7, 2018

Anton and I have been probing the social media for some time about the trends related to SOC and incident response teams. All that work finally made its way into...

Read more »

Is Your SOC your CSIRT?

by Augusto Barros  |  June 27, 2018

As we move forward on updating our SOC research, Anton and I are back to the discussion about the existence of two separate entities in organizations, the SOC and CSIRT....

Read more »

SOAR paper is out!

by Augusto Barros  |  February 22, 2018

Anton beat me this time on blogging about our new research, but I'll do it anyway :-) Our document about Security Orchestration, Automation and Response (SOAR) tools includes some interesting...

Read more »

The "working with an MSSP" Tome Is Here

by Augusto Barros  |  January 30, 2018

As Anton just posted, the new version of the famous "How to Work With an MSSP to Improve Security" has just been published. I'm very happy to become a co-author...

Read more »

Security Monitoring Use Cases, the UPDATE!

by Augusto Barros  |  January 17, 2018

Posting about updated documents is often boring, but this time I'm talking about my favorite Gartner document, as usual, co-authored with Anton: "How to Develop and Maintain Security Monitoring Use Cases"!...

Read more »

Threat Detection Is A Multi-Stage Process

by Augusto Barros  |  December 4, 2017

We are currently working on our SOAR research, as Anton has extensively blogged about. SOAR tools have been used to help organizations  triage and respond to the deluge of alerts...

Read more »

Machine Learning or AI?

by Augusto Barros  |  November 28, 2017

We may sound pedantic when pointing we should be talking about Machine Learning, and not AI, for security threat detection use cases. But there is a strong reason why: to...

Read more »

SIEM, Detection & Response: Build or Buy?

by Augusto Barros  |  July 27, 2017

As Anton already blogged (many times) and twitted about, we are working to refresh some of our SIEM research and also on a new document about SaaS SIEM. This specific...

Read more »

SIEM Correlation is Overrated

by Augusto Barros  |  March 31, 2017

During our research about UEBA tools, we noticed that these tools are gaining ground on SIEM solutions, with some organizations opting to focus their monitoring efforts on UEBA instead of...

Read more »