Security Jiujitsu

Agenda
Four types of security correlaEon rules you probably want
1. CorrelaEon across many sourcetypes and events
– Generate high fidelity alerts
2. Privileged user monitoring
– Detect lateral movement and prioriEze risky users
3. Conquering alert faEgue
– Don’t be beaten by tens of thousands of alerts per day
4. Threat Intel hits
– Immediately detect bad actors in your environment
4