Security Orchestration Automation and Response integrates security tools and processes, enhancing threat detection, investigation, and response. It minimizes human intervention, making security operations more efficient.Security Orchestration Automation and Response solutions streamline incident management by allowing security teams to automate repetitive tasks, analyze threat data from multiple sources, and orchestrate responses to incidents. These solutions typically provide an automated...
@Chiheb Chebbi,
I hope the below test cases are helpful.
Test 1 - Recon: Password Spraying
Test 2 - Privilege Escalation (windows): Powershell Dropper Attacks
Test 3 - Lateral Movement: PsExec
Test 4 - Privilege Escalation (Linux): Failed Sudo
Test 5 - Malicious Code Execution: Eicar Malware Test File
Some examples
https://drertugrulakbas.medium...
As a rule, a SIEM correlation should:
1) Reduce events by 99.99% - raw events to correlations
2) Impact system performance by <1%
3) Produce Correlated Threats with >35% true positive rate on investigation
- 33% are usually false positives or misconfigurations (not real threats)
- 33% are usually unexplained, root cause not discernable
4) Result in <10% false negatives (missed threats)