UNRAVELING SIEM CORRELATION TECHNIQUES

Summary from the TLDR InfoSec newsletter

This post provides an overview of SIEM correlation techniques. It begins by defining correlation, introducing the MITRE ATT&CK framework, and presenting an example of a simple correlation rule. The post then continues to work through an example of detecting a Brute Force Okta Login, while combining multiple TTPs and log sources.