Near-miss situation based visual analysis of SIEM rules for real time network security monitoring

摘要: Security information and event management (SIEM) systems are generally used to monitor the network for malicious activities. These capable of detecting a wide range activities in using built-in rules generate alerts on Although SIEM provide comprehensive reports about each alert including relevant details such as, severity score, events, events counts. However, key limitation is not presenting rule’s status real time before an raised. This paper presents novel visual tool that enables security analyst grasp visually, complete overview execution, circumstances may happen advance based near-miss situation. Apart from analysis, it also analysts explore reasoning behind organized efficient manner via questions. The essence approach evaluate visualize current rule execution according pre-compiled conditions time. We demonstrate utility our IBM QRadar data support informative analysis different time, questions insight story page.