Badges
35 Points
5 Years
User Activity
Almost 3 years ago
Replied to Denis L Why a Security Operations Center (SOC) is important?
@Evgeny Belenky yeah, "alert fatigue" is also a consequence of the human factor.
Without a continuous process of SOC software configuration, SOC will face this "alert fatigue" issue.
One more thing is gaps between different parts of the SOC team. Multi-experts are great,…
Almost 3 years ago
Answered a question: Why a Security Operations Center (SOC) is important?
SOC is the heart of your infrastructure security, a centralized system management mechanism, a collaboration of people and software. It is designed to detect anomalies, highlight real threats in them, and respond to these threats appropriately
SOC has a complex structure…
Over 4 years ago
Answered a question: Threat intelligence tools for large organization
Try Open Threat Exchange otx.alienvault.com The best one, and now researchers from AlienVault is a part of AT&T, so they have really great data sources and expertise in Threat hunting.
Over 4 years ago
Answered a question: What is the difference between SIEM and SOAR platforms?
TLDR
SIEM:
Security information management: Long-term storage as well as analysis and reporting of log data.
Security event manager: Real-time monitoring, correlation of events, notifications, and console views.
SOAR:
SIEM + Threat Intelligence (IoC's, AI, etc),…
Over 4 years ago
Contributed a review of Exinda: Can be used as a network orchestrator so you can be sure that the throughput is managed well and everything gets what it needs
Almost 5 years ago
Answered a question: AlienVault saying I can't use it in a DHCP environment. Help!
In general, you will have the same problems with any software for log analysis in DHCP environments. But you can use FQDN and can also install agents on assets with dynamic IP
But really, you will have some difficulties with asset and vulnerability management. Try to use…
About 5 years ago
Contributed a review of AlienVault OSSIM: Integration with OTX enables us to see which IPs are malicious
Over 5 years ago
Contributed a review of Palo Alto Networks NG Firewalls: Enables us to evaluate traffic in the customer environment by providing detailed reporting on the traffic and applications
Over 5 years ago
Contributed a review of USM Anywhere: Easy to deploy and flexible enough to create your own plugins
Experience
Other Skills
Firewalls, SIEM, EDR, XDR, Vulnerability Management, IoT Security.Following
Reviews
Over 5 years ago
Palo Alto Networks NG Firewalls
Answers
Almost 3 years ago
IT Alerting and Incident Management
Over 4 years ago
Security Information and Event Management (SIEM)
About me
Pre-Sales Ninja!
