Decurity believes that at the heart of Security Operations is the Analytical Framework employed by the security team.  Fully analyzing the data sets available, ensuring the sources of information are reliable and measuring the value of that information in context with other data available and the business role of the systems/networks is imperative to prioritizing security events.

Three fundamentals analytical procedures provide the foundation for this framework, Correlation Analysis and Incident Analysis.

Correlation Analysis

Correlation Analysis is an evolving analytical process that includes using SIEM tools and information security analyst expertise to identify, prioritize and escalate relevant events that require action for resolution.  This is the part of the overall process where intelligent data reduction is realized further adding to the effectiveness of your analytical team in prioritizing and focusing on true security events.

Incident Analysis

Incident Analysis is an in-depth review of all technical and business information related to a security event.   Correlation Analysis, Trend analysis, statistical analysis and packet analysis tools may be employed with in-depth forensic analysis to discover the root cause of the incident.

Advanced Analysis

Advanced Analysis is the non-traditional method of analysis that involved all aspects and data sources available.  You may see visualization, correlation or data mining tools employed to help refine the data set.  Through advanced analysis you will identify new patterns for correlation (SIEM or IDS/IPS) rulesets, additional sources/targets of incidents and help streamline operations by refining existing signatures.