To tame an event queue that's ballooning out of control, you need to know first which rules and data sources are generating a disproportionate number of alerts, and second the security value you're getting from those rules and data sources. Any changes made to rules or telemetry analyzed without that knowledge risk making your organization more vulnerable. In this session we'll discuss how Splunk empowers us to perform advanced analytics on everything from alert conversion rates to human time expenditure on alerts so that we can optimize all processes related to alerting. As long as we know what to measure and where to look, Splunk can help us tune our security operations centers to reduce monotony and false positives without diminishing our ability to detect actual threats.

Speaker(s)
Keshia LeVan, Detection Engineer, Red Canary

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC2105.pdf?podcast=1577146225

Product: Splunk Cloud, Splunk Machine Learning Toolkit

Track: Security, Compliance and Fraud

Level: Advanced