How can you find SIEM platforms that offer machine learning capabilities for anomaly detection?

Research SIEM Providers: Conduct research to identify SIEM providers that offer machine learning capabilities for anomaly detection. Assess Machine Learning Capabilities: Assess the machine learning capabilities of each SIEM platform, including the types of algorithms used, the depth of integration with the SIEM workflow, and the level of customization and tuning available for anomaly detection models. Request Demos and Trials: Reach out to SIEM vendors to request demos or trials of their platforms. Take the opportunity to see the machine learning capabilities in action, ask questions about implementation and integration, and evaluate the usability and effectiveness of the anomaly detection features.

Different SIEM vendors offer different functionalities, so it's important to evaluate the SIEM capabilities based on your specific needs. One example to evaluate how the SIEM with the machine learning capabilities can learn and adapt based on data sources that your organization have. If you have sysmon data sources from Windows Endpoint or auditd log from Linux/Unix endpoint, how fast they can learn based on that logs and then find a potential threat from the logs. While machine learning is powerful, it's not a silver bullet solution. You still need security analysts, threat hinters to play a vital role in creating hypotheses for a novel attack technique, interpreting alerts, investigating incidents, and doing appropriate responses.

To find SIEM platforms with machine learning capabilities for anomaly detection, start by researching reputable vendors known for robust AI and ML integration in cybersecurity. Look for platforms that emphasize real-time anomaly detection using supervised and unsupervised learning algorithms, offering customizable models for diverse data types and network behaviors. Prioritize solutions with proven track records in detecting complex threats through anomaly detection, leveraging AI-driven insights for proactive threat mitigation and streamlined incident response. Additionally, consider platforms with scalable ML frameworks, ensuring adaptability to evolving cyber threats and organizational needs over time.

Worked with one of the SIEM solutions where AI and ML work together quite well. The name of the platform is Seceon. This is quite a new solution but has the potential to move ahead very quickly in the coming days.

Here's what we mean by baseline: Suppose you come to work everyday 9am and visit a couple of feeds to get the summary of the industry for the previous day. Then you start doing your job at 9.15 and have a break at 10.30 till 10.45, work again and go to lunch between 12-1pm and leave office 5 pm. Let your average data consumption be 4-4.5 GB daily, 1 GB of it is uploaded. Machine learning (ML) gets all these (and more) and forms a baseline (something like a daily routine of yours). An anomaly is a significant deviation from this baseline. For example if you come to work at 6am, leave office at 10pm, don't go to lunch (your workstation is not locked) and use 25GB of data, 20 GB is uploaded. ML detects what you have detected too.

Here's my perspective, focusing on how easy it is to get lost in the vendor hype and forget about the practical realities: Whose Community?: If the glowing reviews are all from giant enterprises, it may not scale down well to your org, or be in your budget. "Works" Isn't Binary: Does the ML reduce false positives, or increase true positives? Those aren't the same value proposition. Data In, Results Out: Will the tool integrate with your existing ticketing, etc.? If the good alerts just create more work, it's not helpful. I felt like my job was to stay on the cutting edge. Now I realize my job is to deploy tech that actually makes my team's lives easier. The community can be great for that, as they'll cut through the marketing fluff.